NT Null Session Admin Name Vulnerability
BID:494
Info
NT Null Session Admin Name Vulnerability
| Bugtraq ID: | 494 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jun 28 1999 12:00AM |
| Updated: | Jun 28 1999 12:00AM |
| Credit: | Vulnerability posted on June 28, 1999 to the NT OBJECTives web site by J D Glaser. Solution emailed to SecurityFocus on June 30,1999 by Dustin Childs <[email protected]>. |
| Vulnerable: |
Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 |
| Not Vulnerable: | |
Solution / Fix
NT Null Session Admin Name Vulnerability
Solution:
Establishing a null session in Windows NT opens a variety of flaws, but can be easily prevented. By setting the registry properly, anonymous connections are restricted. The registry setting for this is:
HKLM\System\CurrentControlSet\Control\Lsa
Name: RestrictAnonymous
Type: REG_DWORD
Value: 1
While this has not been tested against this specific code, It has been tested against other information gathering techniques that use a null connection to IPC$. With this registry setting enabled, you are still able to connect to IPC$, but cannot gain any further data about a domain.
Solution:
Establishing a null session in Windows NT opens a variety of flaws, but can be easily prevented. By setting the registry properly, anonymous connections are restricted. The registry setting for this is:
HKLM\System\CurrentControlSet\Control\Lsa
Name: RestrictAnonymous
Type: REG_DWORD
Value: 1
While this has not been tested against this specific code, It has been tested against other information gathering techniques that use a null connection to IPC$. With this registry setting enabled, you are still able to connect to IPC$, but cannot gain any further data about a domain.