BID:1514

Microsoft Windows NT/2000 NetBIOS Name Conflict Vulnerability

Info

Microsoft Windows NT/2000 NetBIOS Name Conflict Vulnerability

Bugtraq ID:	1514
Class:	Serialization Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 27 2000 12:00AM
Updated:	Jul 27 2000 12:00AM
Credit:	Discovered by Network Associates COVERT Labs and publicized in a Microsoft Security Bulletin (MS00-047) on July 27, 2000.
Vulnerable:	Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows NT/2000 NetBIOS Name Conflict Vulnerability

An attacker can send the NetBIOS name service a NetBIOS Name Conflict message even when the receiving machine is not in the process of registering its NetBIOS name. The target will then not attempt to use that name in any future netwrok connection attempts. This can lead to intermittent connectivity problems, or the loss of all NetBIOS functionality.

Exploit / POC

Microsoft Windows NT/2000 NetBIOS Name Conflict Vulnerability

Sir Dystic <[email protected]> has provided the following exploit:

Source - nbname.cpp
Binary - nbname.exe

/data/vulnerabilities/exploits/nbname.exe
/data/vulnerabilities/exploits/nbname.cpp

Solution / Fix

Microsoft Windows NT/2000 NetBIOS Name Conflict Vulnerability

Solution:
Microsoft has released the following patch which mitigates the vulnerability. Conflict messages will only be responded to during the initial name registration process after the patch is applied.

Microsoft Windows NT Enterprise Server 4.0