 | By Chris Mosby After an uneventful patch release earlier this month, we are now faced with a few important issues. The patches themselves are not too serious, but, of course, there are some attacks that Microsoft didn’t get around to patching. |
Flaw in Internet Connection Sharing causes DoS
There’s a vulnerability in the NAT (Network Address Translation) Helper Components (ipnathlp.dll) in Windows Internet Connection Sharing (ICS). The flaw can be exploited by a hacker by sending a DNS (Domain Name System) query to a machine that hosts ICS for a shared network. This can cause the Helper components to crash, resulting in a Denial of Service (DoS) of ICS on the shared network.
For this exploit to work, the hacker has to send the infected DNS query from a client machine on the same shared network as the computer that’s hosting ICS. This flaw has been confirmed in a fully patched Windows XP SP2 system, and exploit code is already available on the Web. It’s been reported that other systems may also be affected, but this hasn’t been confirmed.
What to do: ICS has never been the best way to share an Internet connection between computers. A hardware solution, like the hardware firewall suggested in Brian’s Security Baseline, is a far better option.
More information: CVE-2006-5614, Secunia, ISS, SecurityFocus, OSVDB, FrSIRT, SecurityTracker, eEye
Windows Workstation service vulnerable to DoS
There’s a weakness in the Windows Workstation service, which can be exploited by hackers to cause the service to crash. It can also cause a system to be unresponsive by consuming large amounts of memory. This is done by sending specific data to the NetBIOS service, which then triggers a memory allocation error in svchost.exe.
This flaw has been confirmed on fully patched Windows XP SP2 and Windows 2000 SP4 systems. Other systems may be vulnerable, too, but I haven’t seen any definite reports yet.
What to do: This is another example in which Brian’s Security Baseline is a good reference. Using a good hardware firewall should automatically block the traffic that would be needed by this exploit.
Related posts:
