Microsoft Windows Server Message Block Handlers Remote Buffer Overflow Vulnerability

2005-02-08T00:00:00
ID SMNTC-12484
Type symantec
Reporter Symantec Security Response
Modified 2005-02-08T00:00:00

Description

Description

Microsoft Windows Server Message Block handler is reported prone to a remote buffer-overflow vulnerability. Note that since SMB drivers execute in the kernel memory space, a successful attack can grant a remote attacker unauthorized access with ring-0 privileges. Microsoft has noted that other protocols, such as IPX/SPX, could also be vulnerable to this issue. **Update: Microsoft Windows NT 4.0 has also been reported vulnerable to this issue.

Technologies Affected

  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
  • Microsoft Windows 2000 Professional SP3
  • Microsoft Windows 2000 Professional SP4
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Server SP4
  • Microsoft Windows NT Enterprise Server 4.0
  • Microsoft Windows NT Enterprise Server 4.0 SP1
  • Microsoft Windows NT Enterprise Server 4.0 SP2
  • Microsoft Windows NT Enterprise Server 4.0 SP3
  • Microsoft Windows NT Enterprise Server 4.0 SP4
  • Microsoft Windows NT Enterprise Server 4.0 SP5
  • Microsoft Windows NT Enterprise Server 4.0 SP6
  • Microsoft Windows NT Enterprise Server 4.0 SP6a
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Server 4.0 SP1
  • Microsoft Windows NT Server 4.0 SP2
  • Microsoft Windows NT Server 4.0 SP3
  • Microsoft Windows NT Server 4.0 SP4
  • Microsoft Windows NT Server 4.0 SP5
  • Microsoft Windows NT Server 4.0 SP6
  • Microsoft Windows NT Server 4.0 SP6a
  • Microsoft Windows NT Terminal Server 4.0
  • Microsoft Windows NT Terminal Server 4.0 SP1
  • Microsoft Windows NT Terminal Server 4.0 SP2
  • Microsoft Windows NT Terminal Server 4.0 SP3
  • Microsoft Windows NT Terminal Server 4.0 SP4
  • Microsoft Windows NT Terminal Server 4.0 SP5
  • Microsoft Windows NT Terminal Server 4.0 SP6
  • Microsoft Windows NT Terminal Server 4.0 SP6a
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Workstation 4.0 SP1
  • Microsoft Windows NT Workstation 4.0 SP2
  • Microsoft Windows NT Workstation 4.0 SP3
  • Microsoft Windows NT Workstation 4.0 SP4
  • Microsoft Windows NT Workstation 4.0 SP5
  • Microsoft Windows NT Workstation 4.0 SP6
  • Microsoft Windows NT Workstation 4.0 SP6a
  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows Server 2003 Datacenter Edition Itanium
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Enterprise Edition Itanium
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows XP 64-bit Edition
  • Microsoft Windows XP 64-bit Edition SP1
  • Microsoft Windows XP 64-bit Edition Version 2003
  • Microsoft Windows XP 64-bit Edition Version 2003 SP1
  • Microsoft Windows XP Home
  • Microsoft Windows XP Home SP1
  • Microsoft Windows XP Home SP2
  • Microsoft Windows XP Media Center Edition
  • Microsoft Windows XP Media Center Edition SP1
  • Microsoft Windows XP Media Center Edition SP2
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional SP1
  • Microsoft Windows XP Professional SP2
  • Microsoft Windows XP Tablet PC Edition
  • Microsoft Windows XP Tablet PC Edition SP1
  • Microsoft Windows XP Tablet PC Edition SP2
  • Nortel Networks IP softphone 2050
  • Nortel Networks Mobile Voice Client 2050
  • Nortel Networks Optivity Network Management System
  • Nortel Networks Symposium Call Center Server (SCCS)
  • Nortel Networks Symposium Express Call Center (SECC)

Recommendations

Block external access at the network boundary, unless external parties require service.
Restrict access to TCP ports 139 and 445 at the network perimeter. Grant access for trusted hosts and networks only.

Do not use client software to access unknown or untrusted hosts from critical systems.
Users should avoid connecting to untrusted servers from client computers.

Implement multiple redundant layers of security.
Various memory-protection schemes (such as non-executable and randomly mapped memory segments) may hinder an attacker's ability to exploit this vulnerability to execute arbitrary code.

Microsoft has released an advisory (MS05-011) and updates to address this issue. Microsoft Windows NT 4.0 has also been found vulnerable to this issue. This platform is no longer publicly supported by Microsoft. A patch is available for customers who have an active end-of-life support agreement including extended Windows NT 4.0 support. Customers are advised to contact Microsoft about obtaining and applying this patch. For more information on the end-of-life support agreement, see the following location: http://www.microsoft.com/presspass/features/2004/dec04/12-03NTSupport.asp Nortel Networks has released security advisory 2005005515 acknowledging this issue. Please the referenced advisory for further information.