Microsoft Security Bulletin MS04-006 - Important

Vulnerability in the Windows Internet Naming Service (WINS) Could Allow Code Execution (830352)

Published: February 10, 2004

Version: 1.0

Issued: February 10, 2004
Version Number: 1.0

Summary

Who should read this document:
Customers who are using Microsoft® Windows Internet Naming Service (WINS)®

Impact of vulnerability:
Remote Code Execution

Maximum Severity Rating:
Important

Recommendation:
WINS server administrators should install the patch at the earliest opportunity.

Security Update Replacement:
None

Caveats:
None

Tested Software and Security Update Download Locations:

Affected Software

Non Affected Software

  • Microsoft Windows NT® Workstation 4.0 Service Pack 6a
  • Microsoft Windows 2000 Professional Service Pack 2, Microsoft Windows 2000 Professional Service Pack 3, Microsoft Windows 2000 Professional Service Pack 4
  • Microsoft Windows XP, Microsoft Windows XP Service Pack 1
  • Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit Edition Service Pack 1
  • Microsoft Windows XP 64-Bit Edition Version 2003, Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1

The software listed above has been tested to determine if the versions are affected. Other versions either no longer include security update support or may not be affected. Review the Microsoft Support LifecycleWeb site to determine the support lifecycle for your product and version.

General Information

Technical Details

Technical description:

A security vulnerability exists in the Windows Internet Naming Service (WINS). This vulnerability exists because of the method that WINS uses to validate the length of specially-crafted packets. On Windows Server 2003 this vulnerability could allow an attacker who sent a series of specially-crafted packets to a WINS server to cause the service to fail. Most likely, this could cause a denial of service, and the service would have to be manually restarted to restore functionality.

The possibility of a denial of service on Windows Server 2003 results from the presence of a security feature that is used in the development of Windows Server 2003. This security feature detects when an attempt is made to exploit a stack-based buffer overrun and reduces the chance that it can be easily exploited. This security feature can be forced to terminate the service to prevent malicious code execution. On Windows Server 2003, when an attempt is made to exploit the buffer overrun, the security feature reacts and terminates the service. This results in a denial of service condition of WINS. Because it is possible that methods may be found in the future to bypass this security feature, which could then enable code execution, customers should apply the update. For more information about these security features, visit the following Web site.

On Windows NT and Windows 2000, the nature of the vulnerability is slightly different. WINS will reject the specially-crafted packet and the attack does not result in a denial of service. The vulnerability on these platforms also does not allow code execution. Microsoft is releasing a security update for these platforms that corrects the vulnerable code as a preventive measure to help protect these platforms in case methods are found in the future to exploit this vulnerability.

Mitigating factors:

  • The WINS service is not installed by default.
  • On Windows Server 2003, WINS automatically restarts if it fails. After the third automatic restart, WINS requires a manual restart to restore functionality.
  • On Windows 2000 and Windows NT 4.0, WINS contains the vulnerable code. However, on these platforms this issue does not cause a denial of service.
  • The vulnerability would not enable an attacker to gain any privileges on an affected system. Under the most likely attack scenario, this issue is strictly a denial of service.
  • Firewall best practices and standard default firewall configurations can help protect networks from remote attacks that originate outside the enterprise perimeter. Best practices recommend blocking all ports that are not being used. In most network configurations, the WINS server is not available for connection from over the Internet.

Severity Rating:

Microsoft Windows NT 4.0 Low
Microsoft Windows NT Server 4.0 Terminal Server Edition Low
Microsoft Windows 2000 Low
Microsoft Windows Server 2003 Important

The above assessment is based on the types of systems that are affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability identifier: CAN-2003-0825

Workarounds

Microsoft has tested the following workarounds. These workarounds will not correct the underlying vulnerability. However, they help block known attack vectors. Workarounds may reduce functionality in some cases; in such cases, the reduction in functionality is identified below.

  • Block TCP port 42 and UDP 137 at your firewall.

    These ports are used to initiate a connection with a remote WINS server. Blocking these ports at the firewall will help prevent systems that are behind that firewall from being attacked by attempts to exploit this vulnerability. It is possible that other ports may be found that could be used to exploit this vulnerability. The ports that are listed are the most common attack vectors. Microsoft recommends blocking all inbound unsolicited communication from the Internet.

  • Remove WINS if you do not need it:

    In many organizations, WINS only provides services for legacy systems. If WINS is no longer needed, you could remove it by following this procedure. These steps apply only to Windows 2000 and later. For Windows NT 4.0, follow the procedure that is included in the product documentation.

    To configure WINS components and services:

    1. In Control Panel, open Add or Remove Programs.
    2. Click Add/Remove Windows Components.
    3. On the Windows Components Wizard page, under Components, click Networking Services, and then click Details.
    4. Click to clear the Windows Internet Naming Service (WINS) check box to remove WINS.
    5. Complete the Windows Components Wizard by following the instructions on the screen.

Impact of Workaround: Many organizations require WINS to perform name registration and name resolution functions on their network. Administrators should not remove WINS unless they fully understand the affect that doing so will have on their network. For more information about WINS, see the WINS product documentation. Also, if an administrator is removing the WINS functionality from a server that will continue to provide shared resources on the network, the administrator must correctly reconfigure the system to use the remaining name resolution services within the local network.

Frequently Asked Questions

What is the scope of the vulnerability?
Under the most likely attack scenario this is a denial of service vulnerability on Windows Server 2003. An attacker who successfully exploited this vulnerability could cause WINS to fail on Windows Server 2003. By default, WINS, restarts automatically when it fails in this manner. After the third automatic restart, WINS requires a manual restart to restore functionality. Restarting WINS will allow the service to function correctly. However, WINS would remain vulnerable to another denial of service attack. On Windows NT and Windows 2000, the nature of the vulnerability is slightly different. WINS will reject the specially-crafted packet and the attack does not result in a denial of service. The vulnerability on these platforms also does not allow code execution. Microsoft is releasing a security update for these platforms that corrects the vulnerable code as a preventive measure to help protect these platforms in case methods are found in the future to exploit this vulnerability.

What causes the vulnerability?
This vulnerability exists because of the method that WINS users to validate the length of specially-crafted packets. The possibility of a denial of service on Windows Server 2003 results from the presence of a security feature that is used in the development of Windows Server 2003. This security feature detects when an attempt is made to exploit a stack-based buffer overrun and reduces the chance that it can be easily exploited. This security feature can be forced to terminate the service to prevent malicious code execution. On Windows Server 2003, when an attempt is made to exploit the buffer overrun, the security feature reacts and terminates the service. This results in a denial of service condition of WINS. Because it is possible that methods may be found in the future to bypass this security feature, which could then enable code execution, customers should apply the update. For more information about these security features, visit the following Web site.

What is the Windows Internet Naming Service?
The Windows Internet Name Service (WINS) maps IP addresses to NetBIOS computer names and vice versa. By using WINS servers, individuals can search for resources by computer name instead of by IP address. The benefits of WINS include:

  • Reduces NetBIOS-based broadcast traffic on subnets by permitting clients to query WINS servers to locate remote systems.
  • Supports earlier Windows and NetBIOS-based clients on the network by permitting them to browse lists for remote Windows domains without requiring a local domain controller on each subnet.
  • Supports Domain Name System (DNS) based clients by enabling those clients to locate NetBIOS resources when WINS lookup integration is implemented.

For more information about WINS, see the WINS product documentation.

What might an attacker use the vulnerability to do?
The vulnerability, if exploited, could allow an attacker to cause WINS on Windows Server 2003 to stop responding to all requests. On Windows NT 4.0 and Windows 2000 WINS will reject the specially-crafted packet and the attack does not result in a denial of service.

Who could exploit the vulnerability?
Any anonymous user who could deliver a specially-crafted message to WINS on an affected server could attempt to exploit this vulnerability. Any user who could establish a connection with an affected system by using the affected ports could attempt to exploit this vulnerability.

How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by creating a specially-crafted network message and by sending the message to the affected system. On Windows Server 2003, receipt of such a message could cause the service to fail causing a denial of service. An attacker could also access the affected component through another vector, such as one that would involve logging onto the system interactively or by using another application that passed parameters to the vulnerable component (locally or remotely).

What systems are primarily at risk from the vulnerability?
Only Windows systems that have been configured as WINS servers are vulnerable. Windows NT 4.0 Workstation, Windows 2000 Professional, and Windows XP cannot be configured as WINS servers; therefore, these operating systems are not affected by this vulnerability.

What does the update do?
The update eliminates the vulnerability by changing the method that WINS uses to validate the length of a message before it passes the message to the allocated buffer.

Security Update Information

Installation Platforms and Prerequisites:

For information about the specific security update for your platform, click the appropriate link:

Windows Server 2003 (all versions)

Prerequisites

This security update requires a released version of Windows Server 2003.

Inclusion in Future Service Packs:

The fix for this issue will be included in Windows Server 2003 Service Pack 1.

Installation Information

This security update supports the following Setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

Note You can combine these switches into one command. For backwards compatibility, the security update also supports the Setup switches that are used by the previous version of the setup utility.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows Server 2003:

Windowsserver2003-kb830352-x86-enu /passive /quiet

To install the security update without forcing the computer to restart, use the following command at a command prompt for Windows Server 2003:

Windowsserver2003-kb830352-x86-enu /norestart

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

In some cases, this update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are in use, this update will require a restart. If this occurs, a message appears that advises you to restart.

Removal Information

To remove this update, use the Add or Remove Programs tool in Control Panel.

System administrators can use the Spuninst.exe utility to remove this security update. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB830352$\Spuninst folder. The Spuninst.exe utility supports the following Setup switches:

/? : Show the list of installation switches.

/u: Use unattended mode.

/f: Force other programs to quit when the computer shuts down.

/z: Do not restart when the installation is complete.

/q: Use Quiet mode (no user interaction).

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows Server 2003, Enterprise Edition, Windows Server 2003, Standard Edition, Windows Server 2003, Web Edition, and Windows Server 2003, Datacenter Edition:

Date Time Version Size File Name Folder
31-Oct-2003 17:47 5.2.3790.99 144,384 Wins.exe RTMGDR
31-Oct-2003 17:44 5.2.3790.99 144,384 Wins.exe RTMQFE

Windows Server 2003, 64-Bit Enterprise Edition and Windows Server 2003, 64-Bit Datacenter Edition:

Date Time Version Size File Name Platform Folder
30-Oct-2003 16:58 5.2.3790.99 467,968 Wins.exe IA64 RTMGDR
31-Oct-2003 17:47 5.2.3790.99 144,384 Wwins.exe X86 RTMGDR\WOW
30-Oct-2003 16:58 5.2.3790.99 467,968 Wins.exe IA64 RTMQFE
31-Oct-2003 17:44 5.2.3790.99 144,384 Wwins.exe X86 RTMQFE\WOW

Note When you install this security update on a Windows Server 2003-based computer, the installer checks to see if any of the files that are being updated on your computer have previously been updated by a Microsoft hotfix. If you have previously installed a hotfix to update one of these files, the installer copies the RTMQFE files to your computer. Otherwise, the installer copies the RTMGDR files to your computer. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

824994 Description of the Contents of a Windows Server 2003 Product Update Package

Verifying Update Installation

To verify that a security update is installed on an affected system you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. The Microsoft Baseline Security Analyzer (MBSA) allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations. For additional information about MBSA, please visit the Microsoft Baseline Security Analyzer Web site.

You may also be able to verify the files that this security update is installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP1\KB830352\Filelist

Note This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 830352 security update into the Windows installation source files.

Windows 2000 Server

Prerequisites

For Windows 2000 Server this security update requires Service Pack 2 (SP2), Service Pack 3 (SP3), or Service Pack 4 (SP4).

The software listed above has been tested to determine if the versions are affected. Other versions either no longer include security patch support or may not be affected. Please review the Microsoft Support Lifecycle Web site to determine the support lifecycle for your product and version.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

Inclusion in Future Service Packs:

The fix for this issue will be included in Windows 2000 Service Pack 5.

Installation Information

This security update supports the following Setup switches:

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)

/uninstall Uninstalls the package

Restart Options

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

Note You can combine these switches into one command. For backwards compatibility, the security update also supports the Setup switches that are used by the previous version of the setup utility.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows 2000 Server Service Pack 2, Windows 2000 Server Service Pack 3, Windows 2000 Server Service Pack 4:

Windows2000-kb830352-x86-enu /passive /quiet

To install the security update without forcing the computer to restart, use the following command at a command line prompt for Windows 2000 Server Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4:

Windows2000-kb830352-x86-enu /norestart

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

You must restart your computer after you apply this security update.

Removal Information

To remove this security update, use the Add/Remove Programs tool in Control Panel.

System administrators can use the Spuninst.exe utility to remove this security update. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB830352$\Spuninst folder. The Spuninst.exe utility supports the following Setup switches:

/? : Show the list of installation switches.

/u: Use unattended mode.

/f: Force other programs to quit when the computer shuts down.

/z: Do not restart when the installation is complete.

/q: Use Quiet mode (no user interaction).

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows 2000 Server Service Pack 2, Windows 2000 Server Service Pack 3, Windows 2000 Server Service Pack 4

Date Time Version Size File Name
04-Nov-2003 20:02 5.0.2195.6870 145,168 Wins.exe

Verifying Update Installation

To verify that a security update is installed on an affected system you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. The Microsoft Baseline Security Analyzer (MBSA) allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations. For additional information about MBSA, please visit the Microsoft Baseline Security Analyzer Web site.

You may also be able to verify the files that this security update installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB830352\Filelist

Note This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 830352 security update into the Windows installation source files.

Windows NT 4.0 Server, Windows NT Server 4.0 Terminal Server Edition

Prerequisites

This security update requires Windows NT Server 4.0 Service Pack 6a (SP6a), or Windows NT Server 4.0 Terminal Server Edition Service Pack 6 (SP6).

The software listed above has been tested to determine if the versions are affected. Other versions either no longer include security patch support or may not be affected. Please review the Microsoft Support Lifecycle Web site to determine the support lifecycle for your product and version.

For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack

Installation Information

This security update supports the following Setup switches:

/y: Perform removal (only with /m or /q ).

/f: Force programs to quit during the shutdown process.

/n: Do not create an Uninstall folder.

/z: Do not restart when the update completes.

/q: Use Quiet or Unattended mode with no user interface (this switch is a superset of /m ).

/m: Use Unattended mode with a user interface.

/l: List the installed hotfixes.

/x: Extract the files without running Setup.

Note You can combine these switches into one command.

Deployment Information

To install the security update without any user intervention, use the following command at a command prompt for Windows NT Server 4.0:

Windowsnt4server-kb830352-x86-enu /q

For Windows NT Server 4.0 Terminal Server Edition:

Windowsnt4terminalserver-kb830352-x86-enu /q

To install the security update without forcing the computer to restart, use the following command at a command prompt for Windows NT Server 4.0:

Windowsnt4server-kb830352-x86-enu /z

For Windows NT Server 4.0 Terminal Server Edition:

Windowsnt4terminalserver-kb830352-x86-enu /z

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Restart Requirement

You must restart your computer after you apply this security update.

Removal Information

To remove this security update, use the Add/Remove Programs tool in Control Panel.

System administrators can use the Hotfix.exe utility to remove this security update. The Hotfix.exe utility is located in the %Windir%\$NTUninstallKB830352$ folder. The Spuninst.exe utility supports the following Setup switches:

/y: Perform removal (only with the /m or /q switch).

/f: Force programs to quit during the shutdown process.

/n: Do not create an Uninstall folder.

/z: Do not restart when the installation is complete.

/q: Use Quiet or Unattended mode with no user interface (this switch is a superset of the /m switch).

/m: Use Unattended mode with a user interface.

/l: List the installed hotfixes.

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Windows NT Server 4.0:

Date Time Version Size File Name
08-Jan-2004 11:37 4.0.1381.7255 195,856 Wins.exe

Windows NT Server 4.0 Terminal Server Edition:

Date Time Version Size File Name
04-Nov-2003 14:52 4.0.1381.33554 195,856 Wins.exe

Verifying Update Installation

To verify that a security update is installed on an affected system you may be able to use the Microsoft Baseline Security Analyzer (MBSA) tool. The Microsoft Baseline Security Analyzer (MBSA) allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations. For additional information about MBSA, please visit the Microsoft Baseline Security Analyzer Web site.

You may also be able to verify the files that this security update installed by reviewing the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\KB830352\File 1

Note This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 830352 security update into the Windows installation source files.

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

  • Qualys for reporting the issue in MS04-006.

Obtaining other security updates:

Updates for other security issues are available from the following locations:

  • Security updates are available from the Microsoft Download Center, and can be most easily found by doing a keyword search for "security_patch".
  • Updates for consumer platforms are available from the WindowsUpdate Web site.

Support:

  • Technical support is available from Microsoft Product Support Services at 1-866-PCSAFETY for customers in the U.S. and Canada. There is no charge for support calls that are associated with security updates.
  • International customers can get support from their local Microsoft subsidiaries. There is no charge for support associated with security updates. Information on how to contact Microsoft support is available at the International Support Web Site.

Security Resources:

Software Update Services (SUS):

Microsoft Software Update Services (SUS) enables administrators to quickly and reliably deploy the latest critical updates and security updates to Windows® 2000 and Windows Server™ 2003-based servers, as well as to desktop computers running Windows 2000 Professional or Windows XP Professional.

For information about how to deploy this security update with Software Update Services, visit the Software Update Services Web site.

Systems Management Server (SMS):

Systems Management Server can provide assistance deploying this security update. For information about Systems Management Server visit the SMS Web Site. For detailed information about the many enhancements to the security update deployment process that SMS 2003 provides, please visit the SMS 2003 Security Patch Management Web site. For users of SMS 2.0, it also provides several additional tools to assist administrators in the deployment of security updates such as the SMS 2.0 Software Update Services Feature Pack and the SMS 2.0 Administration Feature Pack. The SMS 2.0 Software Update Services Feature Pack utilizes the Microsoft Baseline Security Analyzer and the Microsoft Office Detection Tool to provide broad support for security bulletin remediation. Some software updates may require administrative rights following a restart of the computer.

Note: The inventory capabilities of the SMS 2.0 Software Update Services Feature Pack may be used for targeting updates to specific computers, and the SMS 2.0 Administration Feature Pack's Elevated Rights Deployment Tool can be used for installation. This provides optimal deployment for updates that require explicit targeting using Systems Management Server and administrative rights after the computer has been restarted.

Disclaimer:

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions:

  • V1.0 February 10, 2004: Bulletin published.

Built at 2014-04-18T13:49:36Z-07:00