Microsoft Windows NT SNMP-WINS DoS Vulnerability

Bugtraq ID:	2244
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 07 1997 12:00AM
Updated:	Oct 07 1997 12:00AM
Credit:	Disclosed on October 7, 1997 by "Rouland, Christopher J" <[email protected]>
Vulnerable:	Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0
Not Vulnerable:	Microsoft Windows NT 4.0 SP6 + Microsoft Windows NT Enterprise Server 4.0 SP6 + Microsoft Windows NT Enterprise Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Workstation 4.0 SP6 + Microsoft Windows NT Workstation 4.0 SP6

Microsoft Windows NT SNMP-WINS DoS Vulnerability

The Simple Network Management Protocol (SNMP) provides remote network administration functions. Windows NT provides an optional SNMP implementation. Windows NT networks can use Windows Internet Name Service (WINS), a DNS-like service, to register clients on the network. The SNMP service provided with NT Server 4.0 and NT Server 4.0 Terminal Server Edition allow a remote user to delete WINS records, initiating a denial of service against the network. The only caveat to this is that the attacker must know the SNMP community name and be able to access the SNMP service. This does represent a significant vulnerability because regular access control functions are bypassed by the SNMP function, and SNMP community names are often left at their default values (eg., "public").

Microsoft Windows NT SNMP-WINS DoS Vulnerability

The following is quoted directly from the message by "Rouland, Christopher J" <[email protected]>:

"Since the SNMP toolset implemented under NT will not do
snmp-set-requests, my sample exploit was done using the CMU SNMP
development kit under Unix. The command "rnjdev02:~/cmu$ snmpset -v 1
192.178.16.2 public .1.3.6.1.4.1.311.1.2.5.3.0 a 192.178.16.2"
successfully entirely deleted my WINS database."

Microsoft Windows NT SNMP-WINS DoS Vulnerability

Solution:
Apply the most recent NT service pack from Microsoft.

Microsoft Windows NT SNMP-WINS DoS Vulnerability

References:

• Q152734 - How to Obtain the Latest Windows NT 4.0 Service Pack (Microsoft)
  
• Q186473 - You Can Delete All Records on a WINS Server Using SNMP (Microsoft)