-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2004.0115 -- Microsoft Security Bulletin MS04-006
        Vulnerability in the Windows Internet Naming Service (WINS)
                   Could Allow Code Execution (830352)
                             11 February 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Windows Internet Naming Service (WINS)
Publisher:              Microsoft
Operating System:       Windows 2003 Server
                        Windows 2000 Server
                        Windows NT Terminal Server Edition
                        Windows NT
Impact:                 Execute Arbitrary Code/Commands
                        Denial of Service
Access Required:        Remote
CVE Names:              CAN-2003-0825

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft has released security bulletin MS04-006 "Vulnerability in the
Windows Internet Naming Service (WINS) Could Allow Code Execution
(830352)".  This bulletin describes a buffer overrun vulnerability in the
WINS service and a related security feature in Windows 2003 Server which
causes to WINS service to stop and restart when it detects a possible
stack-based attack.  For Windows 2003 Server, after the service is stopped
under this condition three times, manual intervention will be required to
retart it.  For Windows 2000 and NT, the vulnerable code in the WINS
service exists, however there is no denial of service condition.

Microsoft have stated that this vulnerability would not allow an attacker
to gain any privileges on the system.

Appropriately configured firewalls will help in mitigating the effects of
this vulnerability.  WINS servers communicate with clients via NetBIOS on
ports 137/tcp and 137/udp, and WINS server replication utilises ports
42/tcp and 42/udp.

Microsoft has rated the severity of this vulnerability as important for
Windows 2003 Server, and rated low for Windows 2000 and NT.

Additional information on this vulnerability and patches is available at:

  http://www.microsoft.com/technet/security/bulletin/MS04-006.asp

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQCmEEyh9+71yA2DNAQFO8AP/ZgJn9AbLwJCyd+o6y8HMw0++y3oSkzMW
pTWIA2/pLOV4rA0kVzu/JWkz3bcELtuSpbESWffD46aR4eGYrsQ2+WQfPeLOKA4T
ldaQKof+BuvTfFp/0VP89GfZRFGhe4C5CVtIlaWqR6uRd+wVpuZkis6XCbM6mAvo
5pmff2O2P2U=
=z7Ki
-----END PGP SIGNATURE-----