Software Engineering Institute

If the SNMP service is running on a Windows 2000 server, and the 'Print Spooler' service is not running, repeatedly using SNMP queries to obtain print queue related values in the LANMAN MIB will cause the SNMP service to consume very large amounts of memory. According to the NGS Software advisory, approximately 30MB of memory is allocated per SNMP request received. Multiple SNMP queries sent in short succession can readily consume all available memory on vulnerable systems. For additional information, see the NGS Software advisory and the Microsoft Knowledge Base Article.

The Windows 2000 server can be caused to crash when all available memory is exhausted, resulting in a denial of service condition.

Microsoft has addressed this vulnerability in Windows 2000 service pack 3 (SP3).

If you cannot upgrade to Windows 2000 SP3, the following steps may help to limit your exposure:

• Disable the SNMP service on systems that do not require it.
• Change community names from their default values. 'public' is commonly used for the read-only community name and 'private' is commonly used for the read-write name.
• Permit SNMP queries from only authorized network managment stations using the 'Services' management snap-in. Filter queries from all other sources using a simple packet filter or an IPsec policy.