Software Engineering Institute

SMB will crash if it receives a crafted SMB_COM_TRANSACTION packet requesting a NetShareEnum transaction, with field "Max Param Count" or "Max Data Count" set to zero (0). On exploitation, the crashed host condition exhibits a blue screen. This vulnerability can be exploited by an attacker with access to a user account on the target system. By default, anonymous users have the required access to exploit this vulnerability; therefore on most Windows systems an attacker does not need to be authenticated.

Attackers can cause a denial of service. Attackers might also be able to execute arbitrary code, though this has not been demonstrated or proven.

Apply a patch

For more information about patches, see

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS02-045.asp

Disable anonymous access

Disable anonymous SMB access. See Microsoft Knowledge Base Article 246261 for information about configuring anonymous access in Windows 2000. This will not prevent authenticated users from exploiting this vulnerability, and may have adverse affects in mixed-mode domains.

Block or Restrict Access

Block access to SMB services (139/tcp, 445/tcp) from untrusted networks such as the Internet.