[ Thanks to David for this link.
]
“The COVERT Lab issued an… advisory earlier this week
detailing how a local Windows networking configuration can be
corrupted by redirecting the user to an arbitrary IP address of the
hacker’s choosing. In itself, say researchers, the vulnerability
isn’t destructive. For malicious crackers it’s more likely to be a
means to an end. But the simplicity and stealth with which the
attack can be carried out means that it merits a high risk rating,
says PGP.”
“All it takes is a single UDP packet sent to whoever is on
the Windows network – it’s unsolicited,” a PGP researcher told The
Register. “That person never needs to ask a question to receive an
invalid response and for their cache to be corrupted, and for that
machine to be the under the control of the attacker. As an
example of potential abuse, PGP’s advisory cites a case where a
rogue SMB (Windows’ file and print network protocol) machine could
be used to capture names and passwords from other users on the LAN,
or over the Internet.”
“COVERT Labs advises users to unbind NetBIOS from the stack, or
turn the protocol off if they’re using Windows 2000. “There’s not a
lot a user can do to minimize their risk,” said Jim Magdych,
security research manager at the lab. … “We’ve had a lot of
discussion with Microsoft about it,” said Magdych. “They said it
would take up too much effort and be too disruptive to the
Microsoft NetBIOS implementation to implement any sort of patch to
correct this problem.”