Title: Microsoft Windows NT SNMP-WINS DoS Vulnerability
Severity: MODERATE
Description:
The Simple Network Management Protocol (SNMP) provides remote network administration functions. Windows NT provides an optional SNMP implementation. Windows NT networks can use Windows Internet Name Service (WINS), a DNS-like service, to register clients on the network. The SNMP service provided with NT Server 4.0 and NT Server 4.0 Terminal Server Edition allow a remote user to delete WINS records, initiating a denial of service against the network. The only caveat to this is that the attacker must know the SNMP community name and be able to access the SNMP service. This does represent a significant vulnerability because regular access control functions are bypassed by the SNMP function, and SNMP community names are often left at their default values (eg., "public").
Affected Products:
- Microsoft Windows NT 4.0
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Workstation 4.0
References:
- Microsoft: Q152734 - How to Obtain the Latest Windows NT 4.0 Service Pack
- Microsoft: Q186473 - You Can Delete All Records on a WINS Server Using SNMP
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
