[ news_security_news ]
Blink Protects From WINS Vulnerability
SecurityProNews
Staff Writer
2004-12-02
 Insider Reports RSS Feed
eEye Digital Security announced that Blink is able to protect enterprises from a critical security vulnerability found within the Windows Internet Naming Service (WINS).
This critical security vulnerability could potentially allow an attacker to remotely take control of a WINS server, which Microsoft provides as the preferred method for registering and querying of machine mappings within a network.
This security issue affects Microsoft Windows NT Server 4.0, Microsoft Windows NT Server 4.0 Terminal Server Edition, Microsoft Windows 2000 Server, and Microsoft Windows Server 2003. To date, Microsoft has not issued a patch for this security flaw, thus leaving countless machines that run critical applications such as Microsoft's Exchange, SQL Server and Active Directory vulnerable to attackers.
"WINS is an excellent example of a security flaw in a platform that has an enormous installed base -- in this case, Windows NT 4.0 -- but is no longer supported by Microsoft with security updates," stated Firas Raouf, eEye's chief operating officer. "In this case, Blink not only protects these vulnerable machines, but prevents the enterprise from being forced into an expensive 'forklift' upgrade to a different operating system."
If successful, an attacker exploiting the WINS vulnerability could gain full system access, taking complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. The protection for this un-patched vulnerability is already included within Blink's non-signature based intrusion prevention technology. Blink is able to identify the method of exploitation, in this case, the sending of a specially crafted WINS replication packet to a vulnerable server, and stop the packets from executing on the OS. Blink does this in a completely non-intrusive manner and does not impact the performance or availability of the host machine.
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
