Multiple Vulnerabilities in Microsoft WINS

Two new vulnerabilities exist in Microsoft WINS.

Ken Pfeil

December 17, 2004

1 Min Read
ITPro Today logo

Reported December 14, 2004, byMicrosoft

VERSIONS AFFECTED

·         Microsoft Windows NT Server 4.0 Service Pack 6a

·         Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6

·         Microsoft Windows 2000 Server Service Pack 3 and Service Pack 4

·         Microsoft Windows Server 2003

DESCRIPTION
Two new vulnerabilities exist in Microsoft WINS. The first vulnerability stemsfrom a flaw in the way that WINS handles computer name validation.  The other vulnerability is in the way that WINShandles association context validation. An attacker could exploit thesevulnerabilities by constructing a malicious network packet that could potentiallyallow remote code execution on an affected system.

VENDOR RESPONSE
Microsoft has released SecurityBulletin MS04-045, "Vulnerability in WINS Could Allow RemoteCode Execution (870763)," to address these vulnerabilities and recommendsthat affected users immediately apply the appropriate patch listed in thebulletin.

CREDIT
Discovered by Kostya Kortchinskyfrom CERT RENATER.

Read more about:

Microsoft
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like