Microsoft Windows WINS Server Network Buffer Length Integer Overflow Vulnerability

ID SMNTC-35981
Type symantec
Reporter Symantec Security Response
Modified 2009-08-11T00:00:00



The Microsoft Windows WINS Server is prone to a remote integer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed exploit attempts will result in a denial-of-service condition.

Technologies Affected

  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Datacenter Server SP4
  • Microsoft Windows 2000 Professional SP4
  • Microsoft Windows 2000 Server SP4


Block external access at the network boundary, unless external parties require service.
Filter access to the affected computer at the network boundary if global access isn't needed. Restricting access to only trusted computers and networks might greatly reduce the likelihood of a successful exploit.

Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Use NIDS to detect suspicious or anomalous network traffic. Monitor logs for signs of malicious activity.

Implement multiple redundant layers of security.
Memory-protection schemes such as nonexecutable stack and heap configurations and randomly mapped memory segments will complicate exploits of memory-corruption vulnerabilities.

The vendor has released an advisory and updates. Please see the references for details.