Warm up the mouse buttons, it’s patch time again for Windows users. Microsoft has acknowledged a flaw in the Windows Internet Naming Service (WINS) that could allow an attack to be launched against the system.
All systems using WINS, which include NT 4.0, Windows 2000, and Windows Server 2003, are affected.
The attack takes the form of a buffer overflow, where the WINS server is sent messages too large for it to handle. By carefully crafting specific data packets, an attacker could exploit this to execute arbitrary code on an affected machine. Secunia currently rates this as a “moderately critical” vulnerability.
Microsoft issued a directive temporarily fixing the issue, but points out that WINS is no longer installed by default and very few organizations still use it. Microsoft’s advice is to restrict traffic between WINS servers using IP security features built into Windows. Or, if you’re not using WINS, just turn it off.
Source: GEEK.com
Articles RSS