Bugtraq mailing list archives
Re: Authentication flaw in microsoft SMB protocol
From: Chris Wysopal <cwysopal () atstake com>
Date: 22 Apr 2003 15:24:24 -0000
In-Reply-To: <909EB55D24CCFD4D9ABABD1B9BD610C609F5DBD8 () red-msg-06 redmond corp microsoft com> On Mon, 21 Apr 2003, Jesper Johansson wrote:
You don't need to wait. This is prevented with NTLM v.2, which shipped with Windows NT 4.0 SP4 in October 1998. This type of attack is also foiled with Kerberos, which is negotiated by default in a Windows 2000 or higher domain.
While this is true, in this attack it is a malicious server which makes the client configuration important. Unless LMCompatabilitylevel has been changed from its default of 0 or "Send LM & NTLM responses" this attack should still work. This is the default on Windows 2000 and XP.
To learn more about using NTLM v.2 and Kerberos, refer to the Windows 2000 Security Hardening Guide: http://www.microsoft.com/technet/security/prodtech/Windows/Win2kHG.asp
The hardening guide recommends setting this level as high as possible and there really isn't any reason these days not to run an NTLMv2 client environment by setting this LMCompatability level to 3 or higher. This can be done through a domain security policy. It is also a good idea to filter TCP ports 139 and 445 outbound on your perimeter if possible. -Chris
Current thread:
- Authentication flaw in microsoft SMB protocol seclab (Apr 19)
- Re: Authentication flaw in microsoft SMB protocol Dave Aitel (Apr 19)
- <Possible follow-ups>
- RE: Authentication flaw in microsoft SMB protocol Jesper Johansson (Apr 22)
- Re[2]: Authentication flaw in microsoft SMB protocol 3APA3A (Apr 23)
- Re: Authentication flaw in microsoft SMB protocol Chris Wysopal (Apr 22)