Windows NT SNMP Service Remote WINS Record Deletion

vendor:

Windows NT

by:

7.5

CVSS

HIGH

Remote WINS Record Deletion

CWE

Product Name: Windows NT

Affected Version From: Windows NT Server 4.0

Affected Version To: Windows NT Server 4.0 Terminal Server Edition

Patch Exists: NO

Related CWE:

CPE: o:microsoft:windows_nt:4.0

Metasploit:

Other Scripts:

Platforms Tested: Windows NT

Windows NT SNMP Service Remote WINS Record Deletion

The SNMP service provided with NT Server 4.0 and NT Server 4.0 Terminal Server Edition allow a remote user to delete WINS records, initiating a denial of service against the network. The attacker must know the SNMP community name and be able to access the SNMP service. Regular access control functions are bypassed by the SNMP function, and SNMP community names are often left at their default values (e.g., 'public').

Mitigation:

Ensure SNMP community names are not left at their default values. Restrict access to the SNMP service and use strong authentication mechanisms. Regularly update and patch the SNMP service.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2244/info


The Simple Network Management Protocol (SNMP) provides remote network administration functions. Windows NT provides an optional SNMP implementation. Windows NT networks can use Windows Internet Name Service (WINS), a DNS-like service, to register clients on the network. The SNMP service provided with NT Server 4.0 and NT Server 4.0 Terminal Server Edition allow a remote user to delete WINS records, initiating a denial of service against the network. The only caveat to this is that the attacker must know the SNMP community name and be able to access the SNMP service. This does represent a significant vulnerability because regular access control functions are bypassed by the SNMP function, and SNMP community names are often left at their default values (eg., "public"). 

"Since the SNMP toolset implemented under NT will not do
snmp-set-requests, my sample exploit was done using the CMU SNMP
development kit under Unix. The command "rnjdev02:~/cmu$ snmpset -v 1
192.178.16.2 public .1.3.6.1.4.1.311.1.2.5.3.0 a 192.178.16.2"
successfully entirely deleted my WINS database."