Software Engineering Institute

The Windows Internet Naming Service (WINS) maps IP addresses to NETBIOS computer names. There is a vulnerability in the way WINS validates the length of specially crafted packets. This could allow an attacker to cause WINS to crash.

According to Microsoft, this vulnerability will only cause a denial of service on Windows Server 2003. While the vulnerable code exists in Windows NT and Windows 2000, WINS will reject the specially crafted packet thus not causing a denial of service.

On Windows Server 2003, an unauthenticated, remote attacker could cause WINS to crash.

Apply Patch
Apply the patch (830352) referenced in Microsoft Security Bulletin MS04-006.

Block or restrict access

As a temporary measure, it is possible to limit the scope of this vulnerability by blocking access to ports used to initiate a connection with a remote WINS server at the network perimeter. These are typically ports 42/tcp and 137/udp. Please note that this workaround does not protect vulnerable WINS servers from internal attacks.

Disable vulnerable service

Disable WINS until a patch can be applied. As a best practice, the CERT/CC recommends disabling all services that are not explicitly required.