Microsoft Windows WINS Server Name Validation Vulnerability
Publish Date: 15 février 2011
Gravité: : Élevé
Identifiant(s) CVE: : CVE-2004-0567
Date du conseil: 15 février 2011
Description
cve: The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers to execute arbitrary code or cause a denial of service (server crash), which results in an "unchecked buffer" and possibly triggers a buffer overflow, aka the "Name Validation Vulnerability."
Information Exposure Rating:
Trend Micro Deep Security shields networks through Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities. Please refer to the filter number and filter name when applying appropriate DPI and/or IDF rules.
Solutions
Trend Micro Deep Security DPI Rule Number: 1001202
Trend Micro Deep Security DPI Rule Name: 1001202 - Identified Suspicious Usage Of Shellcode Encoders
Affected software and version:
- Microsoft Windows 2000 Server SP3
- Microsoft Windows 2000 Server SP4
- Microsoft Windows NT Server 4.0 SP6a
- Microsoft Windows NT Terminal Server 4.0 SP6
- Microsoft Windows Server 2003
- Microsoft Windows Server 2003 64-bit