Microsoft Windows Internet Naming Service (WINS) replication protocol contains a heap-based buffer overflow

Overview

A buffer overflow vulnerability in the Microsoft Windows Internet Naming Service (WINS) replication protocol may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition.

Description

The Microsoft WINS service maps IP addresses to NETBIOS computer names. WINS servers share information via a server-to-server replication protocol that operates on TCP port 42. Connection information for replication peers is stored in a data structure called the association context. Insufficient validation of the buffer where the association context data structure is written allows a heap-based buffer overflow to occur. If a remote attacker supplies a specially crafted replication packet to a vulnerable WINS server, that attacker may be able to exploit the buffer overflow to write arbitrary data to WINS server process memory.

According to Microsoft Knowledge Base Article 890710:

_This security issue affects Microsoft Windows NT 4.0 Server, Microsoft Windows NT Server 4.0 Terminal Server Edition, Windows 2000 Server, and Windows Server 2003. Windows 2000 Professional, Windows XP and Windows Millennium Edition (ME) are not affected by this vulnerability. _

By default, WINS is not installed on Windows NT Server 4.0, Windows NT Server 4.0 Terminal Server Edition, Windows 2000 Server, or Windows Server 2003. By default, WINS is installed and running on Microsoft Small Business Server 2000 and Microsoft Windows Small Business Server 2003. By default, on all versions of Microsoft Small Business Server, the WINS component communication ports are blocked from the Internet, and WINS is available only on the local network.
In addition, since the replication only occurs between servers, only WINS servers are vulnerable. WINS clients are not affected by this vulnerability.

Please refer to Microsoft Security Bulletin MS04-045 for more information regarding this vulnerability and its remediation.

Impact

A remote attacker may be able to execute arbitrary code with SYSTEM privileges or cause a denial-of-service condition.

---

Solution

Apply Patch

Microsoft has released Microsoft Security Bulletin MS04-045 to address this issue.

---

Consider Workarounds in MS04-045

* Removing the WINS service if it is not needed
* Blocking TCP and UDP port 42
* Using IPSec as a communication protocol between WINS servers

For more detailed information please see Microsoft Knowledge Base Article 890710 and Microsoft Security Bulletin MS04-045.

Vendor Information

145134

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: December 16, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Microsoft has released Microsoft Security Bulletin MS04-045 to address this issue.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23145134 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.immunitysec.com/downloads/instantanea.pdf&gt;
• <http://www.immunitysec.com/downloads/instantanea.sxw&gt;
• <http://support.microsoft.com/kb/890710&gt;
• <http://www.microsoft.com/technet/security/bulletin/MS04-045.mspx&gt;
• <http://xforce.iss.net/xforce/alerts/id/184&gt;
• <http://www.securityfocus.com/bid/11763&gt;

Acknowledgements

This vulnerability was reported by Nicolas Waisman.Information regarding this vulnerability was provided by the CERT/CC staff, Immunity, Microsoft Knowledge Base Article 890710, and Microsoft Security Bulletin MS04-045.

This document was written by Jeff Gennari.

Other Information

CVE IDs:	CVE-2004-1080
Severity Metric:	26.29 Date Public: