Re: [Full-disclosure] Re: It's not that simple...

From: Jason Coombs (jasonc_at_science.org)
Date: 08/18/05

  • Next message: yossarian: "Re: [Full-disclosure] Re: It's not that simple..." 
    Date: Wed, 17 Aug 2005 12:24:37 -1000
To: Kurt Seifried <listuser@seifried.org>

    Kurt Seifried wrote:
    > Actually it really is that simple. Disabling Null sessions is entirely
    > possible, quite easy, and doesn't break a lot (at least in my previous

    Then why doesn't Microsoft provide these instructions in the workarounds
    section of the vulnerability announcement? Are you certain, Kurt, that
    the proposed registry hack is sufficient to prevent PnP null sessions?
    Perhaps they branch differently in the Windows 2000 code base.

    http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx
            
    Workarounds for Plug and Play Vulnerability - CAN-2005-1983:

    Microsoft has tested the following workarounds. While these workarounds
    will not correct the underlying vulnerability, they help block known
    attack vectors. When a workaround reduces functionality, it is
    identified in the following section.

    Note Other protocols, such as Internetwork Packet Exchange (IPX) and
    Sequenced Packet Exchange (SPX), could be vulnerable to this issue. If
    you are using vulnerable protocols such as IPX and SPX, you should block
    the appropriate ports for those protocols. For more information about
    IPX and SPX, visit the following Microsoft Web site.

    Note As mentioned in the “Mitigating Factors” section, Windows XP
    Service Pack 2 and Windows Server 2003 are vulnerable to this issue
    primarily from locally logged on users. The following workarounds are
    designed primarily for earlier operating system versions that are
    vulnerable to anonymous network-based attacks.
    •

    Block TCP ports 139 and 445 at the firewall:

    These ports are used to initiate a connection with the affected
    protocol. Blocking them at the firewall, both inbound and outbound, will
    help prevent systems that are behind that firewall from attempts to
    exploit this vulnerability. We recommend that you block all unsolicited
    inbound communication from the Internet to help prevent attacks that may
    use other ports. For more information about ports, visit the following
    Web site.
    •

    To help protect from network-based attempts to exploit this
    vulnerability, use a personal firewall, such as the Internet Connection
    Firewall, which is included with Windows XP Service Pack 1.

    By default, the Internet Connection Firewall feature in Windows XP
    Service Pack 1 helps protect your Internet connection by blocking
    unsolicited incoming traffic. We recommend that you block all
    unsolicited incoming communication from the Internet.

    To enable the Internet Connection Firewall feature by using the Network
    Setup Wizard, follow these steps:

    1.
            

    Click Start, and then click Control Panel.

    2.
            

    In the default Category View, click Network and Internet Connections,
    and then click Setup or change your home or small office network. The
    Internet Connection Firewall feature is enabled when you select a
    configuration in the Network Setup Wizard that indicates that your
    system is connected directly to the Internet.

    To configure Internet Connection Firewall manually for a connection,
    follow these steps:

    1.
            

    Click Start, and then click Control Panel.

    2.
            

    In the default Category View, click Networking and Internet Connections,
    and then click Network Connections.

    3.
            

    Right-click the connection on which you want to enable Internet
    Connection Firewall, and then click Properties.

    4.
            

    Click the Advanced tab.

    5.
            

    Click to select the Protect my computer or network by limiting or
    preventing access to this computer from the Internet check box, and then
    click OK.

    Note If you want to enable certain programs and services to communicate
    through the firewall, click Settings on the Advanced tab, and then
    select the programs, the protocols, and the services that are required.
    •

    To help protect from network-based attempts to exploit this
    vulnerability, enable advanced TCP/IP filtering on systems that support
    this feature.

    You can enable advanced TCP/IP filtering to block all unsolicited
    inbound traffic. For more information about how to configure TCP/IP
    filtering, see Microsoft Knowledge Base Article 309798.
    •

    To help protect from network-based attempts to exploit this
    vulnerability, block the affected ports by using IPsec on the affected
    systems.

    Use Internet Protocol security (IPsec) to help protect network
    communications. Detailed information about IPsec and about how to apply
    filters is available in Microsoft Knowledge Base Article 313190 and
    Microsoft Knowledge Base Article 813878.
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: yossarian: "Re: [Full-disclosure] Re: It's not that simple..."

    Relevant Pages

    • Re: [Full-disclosure] Re: Its not that simple...
      ... > will not correct the underlying vulnerability, ... the Internet Connection Firewall feature in Windows XP Service ... > To enable the Internet Connection Firewall feature by using the Network ...
      (Full-Disclosure)
    • problem w/ setting up Internet Connection Firewall
      ... To enable or disable Internet Connection Firewall Open ... Network Connections Click the Dial-up, ... On the Advanced tab, under Internet Connection Firewall, ... Protect my computer and network by limiting or preventing ...
      (microsoft.public.windowsxp.security_admin)
    • Re: cant turn on firewall
      ... To enable or disable Internet Connection Firewall: ... Open Network Connections ... -- You should not enable Internet Connection Firewall on virtual private ...
      (microsoft.public.windowsxp.security_admin)
    • Firewall Problem
      ... To enable or disable Internet Connection Firewall ... Open Network Connections ... On the Advanced tab, under Internet Connection Firewall, ... To open Network Connections, click Start, click Control ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Will wipeing the hard drive kill the sasser virus?
      ... because the vulnerability will still be there when you reinstall. ... You should turn on your Internet Connection Firewall (ICF) ... and then click Network Connections. ...
      (microsoft.public.security.virus)