Article ID: 824105 - Last Review: December 3, 2007 - Revision: 13.13 MS03-034: Flaw in NetBIOS could lead to information disclosureOn This PageSYMPTOMSNetwork basic input/output system (NetBIOS) is an API that
can be used by programs on a local area network (LAN). NetBIOS provides
programs with a uniform set of commands for requesting the lower-level services
that the programs must have to manage names, conduct sessions, and send
datagrams between nodes on a network. A security issue has been identified in Microsoft Windows that could allow an attacker to see information in your computer’s memory over a network. This vulnerability involves one of the NetBIOS over TCP/IP (NetBT) services, the NetBIOS Name Server (NBNS). With this service, you can find a computer's IP address by using its NetBIOS name, and vice versa. Under certain conditions, the response to a NetBT name service query may, in addition to the usual reply, contain random data from the destination computer's memory. This data may be a piece of HTML if the user on the destination computer is using an Internet browser, or it may contain other types of data that existed in memory at the time when the destination computer responded to a NetBT name service query. An attacker could seek to exploit this vulnerability by sending the destination computer a NetBT name service query and then looking carefully at the response to determine whether any random data from that computer's memory is included. Note If typical security practices are followed and if port 137 User Datagram Protocol (UDP) is blocked at the firewall, Internet-based attacks are not possible. Mitigating Factors
RESOLUTIONSecurity Patch InformationFor more information about how to resolve this vulnerability, click the appropriate link in the following list.Windows Server 2003 (all versions)Download InformationThe following files are available for download from the Microsoft Download Center: Windows Server 2003 (32-bit Editions) Collapse this image  Collapse this image For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591
(http://support.microsoft.com/kb/119591/
)
How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
PrerequisitesThis security patch requires the released version of Windows Server 2003.Installation InformationThis security patch supports the following Setup switches:
Deployment InformationTo install the security patch without any user intervention, use the following command:WindowsServer2003-KB824105-x86-ENU /u /q To install the security patch without forcing the computer to
restart, use the following command: WindowsServer2003-KB824105-x86-ENU /z Note You can combine these switches in one command.For information about how to deploy this security patch with Software Update Services, visit the following Microsoft Web site: http://technet.microsoft.com/en-us/wsus/bb466201.aspx
(http://technet.microsoft.com/en-us/wsus/bb466201.aspx)
Restart RequirementYou must restart your computer after you apply this security patch.Removal InformationTo remove this security patch, use the Add or Remove Programs tool in Control Panel.System administrators can use the Spuninst.exe utility to remove this security patch. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB824105$\Spuninst folder. The utility supports the following Setup switches:
Security Patch Replacement InformationThis security patch does not replace any other security patches.File InformationThe English version of this security patch has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Date Time Version Size File name Folder Platform --------------------------------------------------------------------------- 18-Jul-2003 15:15 5.2.3790.69 534,016 Netbt.sys Rtmgdr Ia64 18-Jul-2003 15:15 5.2.3790.69 534,016 Netbt.sys Rtmqfe Ia64 18-Jul-2003 15:16 5.2.3790.69 195,072 Netbt.sys Rtmgdr X86 18-Jul-2003 15:15 5.2.3790.69 195,072 Netbt.sys Rtmqfe X86 824994
(http://support.microsoft.com/kb/824994/
)
Description of the contents of a Windows Server 2003 product update package
You can verify the files that this security patch
installs by reviewing the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Server 2003\SP1\KB824105\Filelist To verify the individual files, use the date/time and version
information that is provided in the file information table to make sure that
the correct files are present on the computer.Windows XPDownload InformationThe following files are available for download from the Microsoft Download Center:Windows XP Home Edition, Windows XP Professional, Windows XP Media Center Edition, and Windows XP Tablet PC Edition Collapse this image Collapse this image Collapse this image For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591
(http://support.microsoft.com/kb/119591/
)
How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
PrerequisitesThis security patch requires the released version of Windows XP or Windows XP Service Pack 1 (SP1). For additional information, click the following article number to view the article in the Microsoft Knowledge Base:322389
(http://support.microsoft.com/kb/322389/
)
How to obtain the latest Windows XP service pack
Installation InformationThis security patch supports the following Setup switches:
Deployment InformationTo install the security patch without any user intervention, use the following command:WindowsXP-KB824105-x86-ENU /u /q To install the security patch without forcing the computer to
restart, use the following command: WindowsXP-KB824105-x86-ENU /z Note You can combine these switches in one command.For information about how to deploy this security patch with Software Update Services, visit the following Microsoft Web site: http://technet.microsoft.com/en-us/wsus/bb466201.aspx
(http://technet.microsoft.com/en-us/wsus/bb466201.aspx)
Restart RequirementYou must restart your computer after you apply this security patch.Removal InformationTo remove this security patch, use the Add or Remove Programs tool in Control Panel.Security Patch Replacement InformationThis security patch does not replace any other security patches.File InformationThe English version of this security patch has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Windows XP Home Edition, Windows XP Professional, Windows XP Media Center Edition, and Windows XP Tablet PC Edition
Date Time Version Size File name Platform
-------------------------------------------------------------------------------
23-Jul-2003 16:15 5.1.2600.117 149,120 Netbt.sys X86 (pre-SP1)
08-Jul-2003 21:48 5.1.2600.1243 149,248 Netbt.sys X86 (with SP1)
Date Time Version Size File name Platform
-------------------------------------------------------------------------------
23-Jul-2003 16:15 5.1.2600.117 553,088 Netbt.sys Ia64 (pre-SP1)
08-Jul-2003 21:49 5.1.2600.1243 553,728 Netbt.sys Ia64 (with SP1)
Windows XP 64-bit Edition Version 2003 Date Time Version Size File name Folder Platform --------------------------------------------------------------------------- 18-Jul-2003 15:15 5.2.3790.69 534,016 Netbt.sys Rtmgdr Ia64 18-Jul-2003 15:15 5.2.3790.69 534,016 Netbt.sys Rtmqfe Ia64 328848
(http://support.microsoft.com/kb/328848/
)
Description of dual-mode update packages for Windows XP
Note When you install the Windows XP 64-bit Edition Version 2003
security patch on a computer that is running Windows XP 64-bit Edition Version
2003, the installer checks to see whether any of the files that are being
updated on your computer have previously been updated by a Microsoft hotfix. If
you previously installed a hotfix to update one of these files, the installer
copies the hotfix files to your computer. Otherwise, the installer copies the
General Distribution Releases (GDR) files to your computer.
For additional
information, click the following article number to view the article in the
Microsoft Knowledge Base: 824994
(http://support.microsoft.com/kb/824994/
)
Description of the contents of a Windows Server 2003 product update package
You can verify the files that this security patch
installs by reviewing the following registry key.Windows XP: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP1\KB824105\Filelist Windows XP with Service Pack 1 (SP1): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP2\KB824105\Filelist To verify individual files, use the date/time and version
information that is provided in the file information table to make sure that
the correct file is present on the computer.Windows 2000 ServerDownload InformationThe following file is available for download from the Microsoft Download Center: Collapse this image For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591
(http://support.microsoft.com/kb/119591/
)
How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
Note This security patch will not install on Windows 2000 Datacenter Server. For information about how to obtain a security patch for Windows 2000 Datacenter Server, contact your participating OEM vendor. For additional information about Windows 2000 Datacenter Server, click the following article number to view the article in the Microsoft Knowledge Base: 265173
(http://support.microsoft.com/kb/265173/
)
The
Datacenter program and Windows 2000 Datacenter Server product
PrerequisitesThis security patch requires Windows 2000 Service Pack 3 (SP3) or Windows 2000 Service Pack 4 (SP4).For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 260910
(http://support.microsoft.com/kb/260910/
)
How
to obtain the latest Windows 2000 service pack
Installation InformationThis security patch supports the following Setup switches:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB824105 Deployment InformationTo install the security patch without any user intervention, use the following command:Windows2000-KB824105-x86-ENU /u /q To install the security patch without forcing the computer to
restart, use the following command: Windows2000-KB824105-x86-ENU /z Note You can combine these switches in one command.For information about how to deploy this security patch with Software Update Services, visit the following Microsoft Web site: http://technet.microsoft.com/en-us/wsus/bb466201.aspx
(http://technet.microsoft.com/wsus/bb466201.aspx)
Restart RequirementYou must restart your computer after you apply this security patch.Removal InformationTo remove this security patch, use the Add or Remove Programs tool in Control Panel.System administrators can use the Spuninst.exe utility to remove this security patch. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB824105$\Spuninst folder. The utility supports the following Setup switches:
Security Patch Replacement InformationThis security patch does not replace any other security patches.File InformationThe English version of this security patch has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Date Time Version Size File name -------------------------------------------------------------- 16-Jul-2003 17:44 5.0.2195.6783 163,600 Netbt.sys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB824105\Filelist To verify individual files, use the date/time and version
information that is provided in the file information table to make sure that
the correct files are present on the computer.Windows NT Workstation 4.0 Workstation and Windows NT Server 4.0 ServerDownload InformationThe following files are available for download from the Microsoft Download Center:Windows NT Workstation 4.0 and Windows NT Server 4.0 Server: Collapse this image Collapse this image For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591
(http://support.microsoft.com/kb/119591/
)
How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
PrerequisitesThis security patch requires Windows NT 4.0 Service Pack 6a (SP6a) or Windows NT Server 4.0, Terminal Server Edition Service Pack 6 (SP6).For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 152734
(http://support.microsoft.com/kb/152734/
)
How to obtain the latest Windows NT 4.0 service pack
Installation InformationThis security patch supports the following Setup switches:
Deployment InformationTo install the security patch without any user intervention on a Windows NT 4.0-based computer, use the following command:WindowsNT4Server-KB824105-x86-ENU.EXE /q To install the security patch without any user intervention on a
Windows NT 4.0 Server, Terminal Server Edition-based computer, use the
following command:WindowsNT4TerminalServer-KB824105-x86-ENU.EXE /q To install the security patch on a Windows NT 4.0-based computer
without forcing the computer to restart, use the following command: WindowsNT4Server-KB824105-x86-ENU.EXE /z To install the security patch on a Windows NT 4.0 Server,
Terminal Server Edition-based computer without forcing the computer to restart,
use the following command: WindowsNT4TerminalServer-KB824105-x86-ENU.EXE /z Note You can combine these switches in one command.For information about how to deploy this security patch with Software Update Services, visit the following Microsoft Web site: http://technet.microsoft.com/en-us/wsus/bb466201.aspx
(http://technet.microsoft.com/en-us/wsus/bb466201.aspx)
Restart RequirementYou must restart your computer after you apply this security patch.Removal InformationTo remove this security patch, use the Add or Remove Programs tool in Control Panel.System administrators can use the Hotfix.exe utility to remove this security patch. The Hotfix.exe utility is located in the %Windir%\$NTUninstallKB824105$ folder. The utility supports the following Setup switches:
Security Patch Replacement InformationThis security patch does not replace any other security patches.File InformationThe English version of this security patch has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Windows NT 4.0 Server: Date Time Version Size File name -------------------------------------------------------------- 16-Jul-2003 13:44 4.0.1381.7224 125,296 Netbt.sys Date Time Version Size File name -------------------------------------------------------------- 16-Jul-2003 13:44 4.0.1381.7224 125,296 Netbt.sys WORKAROUNDAlthough Microsoft urges all customers to apply the security
patch at the earliest possible opportunity, there are several workarounds that
you can use in the interim that may help to prevent the vector that is used to
exploit this vulnerability. These workarounds are temporary measures. They may only help to block the paths of attack. They do not correct the underlying vulnerability. The following sections provide information that you can use that may help to protect your computer from attack. Each section describes the workarounds that you can use, depending on your computer’s configuration and depending on the level of functionality that you require.
http://technet2.microsoft.com/WindowsServer/en/library/28d7c0c4-539e-4510-9431-9e52d24e0a021033.mspx?mfr=true
(http://technet2.microsoft.com/WindowsServer/en/library/28d7c0c4-539e-4510-9431-9e52d24e0a021033.mspx?mfr=true)
STATUS Microsoft has confirmed that this problem may
cause a degree of security vulnerability in the Microsoft products that are
listed in the "Applies To" section..
MORE INFORMATION For more information about this vulnerability, visit the
following Microsoft Web site: http://www.microsoft.com/technet/security/bulletin/MS03-034.mspx
(http://www.microsoft.com/technet/security/bulletin/MS03-034.mspx)
APPLIES TO
| Article Translations
|
| United States | Change | | | All Microsoft Sites |
Help and Support
Back to the top
|
