RE: SUMMARY: SMB overflow attacks
From: Peter Gutmann (pgut001@cs.auckland.ac.nz)Date: 08/30/02
- Previous message: monti: "RE: SUMMARY: SMB overflow attacks"
- Maybe in reply to: Jason Coombs: "SUMMARY: SMB overflow attacks"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 30 Aug 2002 17:25:09 +1200 (NZST) From: pgut001@cs.auckland.ac.nz (Peter Gutmann) To: jasonc@science.org, vuln-dev@security-focus.com
"Jason Coombs" <jasonc@science.org> writes:
>UPDATE: I double-checked and in fact was able to stop port 445 from binding
>at all under Windows 2000 using the following Registry key:
>
>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
>
>under this key remove the default value "\Device\" from the TransportBindName
>REG_SZ value. upon reboot, port 445 is gone completely, both TCP and UDP.
Wonderful! One minor comment on this, removing the entire TransportBindName
has the same effect and can be done automatically with a regdel
(http://www.flos-freeware.ch/regdel.html) script at boot time. This is
somewhat safer than a one-off edit of a value entry, since these sorts of
things have a nasty self-healing capability which occurs when applying service
packs or making changes to network configs.
Peter.
- Previous message: monti: "RE: SUMMARY: SMB overflow attacks"
- Maybe in reply to: Jason Coombs: "SUMMARY: SMB overflow attacks"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
