RE: SMB overflow attacks

From: Jason Coombs (jasonc@science.org)
Date: 08/27/02 

From: "Jason Coombs" <jasonc@science.org>
To: "KF" <dotslash@snosoft.com>, <vuln-dev@security-focus.com>, <incidents@security-focus.com>, <full-disclosure@lists.netsys.com>
Date: Mon, 26 Aug 2002 13:33:02 -1000

On a related subject, I've been struggling for weeks to turn off port 445
completely. It's not happening. The port is bound by the System process on
both TCP and UDP, and System also binds to and listens on a port above 1024
for some unknown reason.

Turning off port 139 by disabling file and printer sharing and NetBIOS over
TCP/IP (NetBT) (remove Client for Microsoft Networks, turn off Lanman server
and RPC services or bind them to the loopback adapter) gets rid of port 139
bindings or forces the binding to a harmless interface -- and it appears
possible to disable SMB-based services, but so far I've found no way to stop
port 445 binding ... System binds to port 445 on all interfaces (0.0.0.0) no
matter what.

TCP/IP port filtering can be turned on to force TCP SYN ACK RESET in
response to any TCP SYN which should prevent any packets from reaching the
SMB service that the System process refuses to unbind from port 445.

Does anyone have any information about why System binds to a port above
1024, and what can be done, if anything, to force Windows 2000/XP/.NET
Server to stop binding to port 445 TCP and UDP?

Thanks.

Jason Coombs
jasonc@science.org

-----Original Message-----
From: KF [mailto:dotslash@snosoft.com]
Sent: Monday, August 26, 2002 10:03 AM
To: vuln-dev@security-focus.com; incidents@security-focus.com;
full-disclosure@lists.netsys.com
Subject: SMB overflow attacks

Does anyone have log entries from a confirmed attack based on the recent
SMB overflows?

http://online.securityfocus.com/bid/5556 and
http://online.securityfocus.com/advisories/4416

I have a client with some unusual log entries related to lanman and SMB
headers.... the log issues are similar to the following article:

http://support.microsoft.com/default.aspx?scid=kb;[LN];Q321733

After applying the fix mentioned in the security-focus bid the server
seemed to be happy... this makes me think the reason the server
was arrgivated is related to a DoS attack on SMB.

I just need something solid to either trace back to an attacker or a
confirmation that I was even attacked.

-KF

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • RE: SSH server under attack...
    ... Dave and et al, ... Subject: Re: SSH server under attack... ... > I changed the port of the SSH server from 22 to 2222. ...
    (Security-Basics)
  • UT DDoS risk
    ... UDP 7778 is for server querying. ... - The host A send 1 empty UDP packet with the source IP of the host C ... (UT default port) ... The host A after 2 mins and 30 secs can restart the attack. ...
    (Bugtraq)
  • Re: SSH server under attack...
    ... > My SSH server has been under DoS and I cant stop it!!! ... > I changed the port of the SSH server from 22 to 2222. ... the new machine to attack me is 200.55.192.29. ... > Computer Emergency Response Teams, ...
    (Security-Basics)
  • PivX Multi-Vendor Game Server dDoS Advisory
    ... Battlefield 1942 (Server and Dedicated Server) ... Battlefield 1942 servers listen on UDP port 23000, ... This is an attack that can easily flood any system slower than the ...
    (Bugtraq)
  • RE: Strange loopback in firefox.
    ... described as heavy attack from outside IP addresses. ... either using the Microsoft_DS port or epmap port to connect). ... For example a connection from port 3014 to 3015 and the next ... to facilitate one-on-one interaction with one of our expert instructors. ...
    (Security-Basics)