Re: Using Messenger Service for 'Net Send' Functionality --- Dangerous? Why?

From: Matt Ostiguy (ostiguy_at_gmail.com)
Date: 06/10/05

  • Next message: Kevin Green: "Re: Restricting file server to access to domain computers only." 
    Date: Fri, 10 Jun 2005 17:03:17 -0400
To: focus-ms@securityfocus.com

    Ugh. There isn't much of an audit trail for it (as opposed to email
    notifications, for example). There is no security on it whatsoever-
    any nitwit could

    net send * bad message here

    resulting in everyone on the subnet getting a "bad message here" popup

    You'd be reliant upon a working WINS infrastructure, but would still
    have issues if the specific user was not logged in. If a user is
    logged into > 1 machine, I believe only the last machine they logged
    into will get it (as my WINS console only shows my username registered
    once for the [03h] netbios name type.

    So, you would be potentially activating another service, thus gaining
    whatever potential security vulnerabilites lie within, only to obtain
    a fairly unreliable notification method.

    Matt

    On 2 Jun 2005 19:20:04 -0000, deadly.halo@gmail.com
    <deadly.halo@gmail.com> wrote:
    > A fellow network administrator at the company I work for is interested in implementing a system that utilizes the Messenger Service (not to be confused with the MS Messenger chat tool) to initiate Net Send notifications to clients throughout the user community. Our network hosts consist of Windows 2000/XP machines (XP has the service disabled by default, 2000 may as well). I remember that there was a large vulnerability reported at the end of 2003 regarding the Messenger Service. I know that the issue was addressed in subsequent service packs, but this doesn't necessarily mean it's a good idea to use it.
    >
    > Bottom line; I'm concerned that enabling the Messenger Service throughout the network will open our environment to security vulnerabilities. What are you thoughts? Any know issues at this time? Your input would be greatly appreciated.
    >
    > Regards,
    >
    > Brian
    >
    > ---------------------------------------------------------------------------
    > ---------------------------------------------------------------------------
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Kevin Green: "Re: Restricting file server to access to domain computers only."

    Relevant Pages

    • Re: Security Center - Control Panel opens on first login...
      ... functionality of the components that are monitored by the Security ... receive notifications re: WU/AU, AV, etc. ... control panel on the first login for each user post update to SP2. ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Security fears over MS October patches...
      ... > haven't received an alert from M$ in at least 7 months. ... Their new services are good at not only alerting you to new security ... issues remediation and patch issues as well as revisions on old patches. ... I get 3 to 4 mails a week from M$ on their security notifications. ...
      (alt.computer.security)
    • Re: Security Center - Control Panel opens on first login...
      ... functionality of the components that are monitored by the Security ... receive notifications re: WU/AU, AV, etc. ... control panel on the first login for each user post update to SP2. ... disabling the wscsvc service entirely, but that's not what i'm after. ...
      (microsoft.public.windowsxp.security_admin)
    • Is firewall active
      ... I recently installed SP2 and the security center shows my fire wall is ... I had been using McAfee and am used to seeing a lot of notifications ...
      (microsoft.public.windowsxp.general)