Microsoft Windows WINS Server Name Validation Vulnerability

Publish date: February 15, 2011
  Severity: HIGH
  CVE Identifier: CVE-2004-0567
  Advisory Date: FEB 15, 2011

  DESCRIPTION

 cve: The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers to execute arbitrary code or cause a denial of service (server crash), which results in an "unchecked buffer" and possibly triggers a buffer overflow, aka the "Name Validation Vulnerability."

  TREND MICRO PROTECTION INFORMATION

Trend Micro Deep Security shields networks through Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities. Please refer to the filter number and filter name when applying appropriate DPI and/or IDF rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1001202
  Trend Micro Deep Security DPI Rule Name: 1001202 - Identified Suspicious Usage Of Shellcode Encoders

  AFFECTED SOFTWARE AND VERSION

  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Server SP4
  • Microsoft Windows NT Server 4.0 SP6a
  • Microsoft Windows NT Terminal Server 4.0 SP6
  • Microsoft Windows Server 2003
  • Microsoft Windows Server 2003 64-bit

Featured Stories