1. Symantec/
  2. Security Response/
  3. Attack Signatures/
  4. NetBIOS RFPoison DoS

NetBIOS RFPoison DoS

Severity: Medium

This attack could pose a moderate security threat. It does not require immediate action.

Description

This signature detects the RFPoison denial of service attack tool.

Additional Information

A specially crafted packet can cause a denial of service on an NT 4.0 host, rendering local administration and network communication nearly unusable. This attack will crash the "services" executable, which in turn, disables the ability for the machine to perform actions via named pipes. As a consequence, users will be unable to remotely logon, logoff, manage the registry, create new file share connections, or perform remote administration. Services such as Internet Information Server may also fail to operate as expected. Rebooting the affected machine will resolve the issue, provided it is not attacked again.

The problem lies within the manner that srvsvc.dll makes calls to services.exe. Certain MSRPC calls will return NULL values which are not correctly interpreted by services.exe. This, in turn, may lead to a crash of Services.exe.

If this denial of service is combined with a number of other exploits, it may be possible to have this attack spawn a Debugger (ie Dr Watson) call on the host, which, if trojaned, may execute malicious code on the target host.

Affected

  • Microsoft Windows NT 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP4, 4.0 SP5, 4.0 SP6

Response

Microsoft has released patches to addres this isssue for all platforms except NT Server Terminal Server Edition.

They are available at:

Windows NT Workstation, Windows NT Server, and Windows NT Server, Enterprise Edition:
Download Patch for x86
Download Patch for alpha

Enable the 'RestrictAnonymous' key

Open the registry:
\HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa If you don't have it, you need to create a DWORD key named 'RestrictAnonymous', with a value of '1'. This will restrict anonymous SMB connections (which RFPoison uses). This should not affect legitimate users of the system.
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube