Microsoft Windows 2000 contains a flaw that may allow a remote denial of service. The issue is triggered when (a) multiple connections to TCP Port 445 occurs or (b) a malicious user sends a stream of malformed packets or null characters to TCP Port 445, and will result in loss of availability for the system.

Upgrade to Service Pack 3 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s):

1. Disable access to TCP Port 445, either with the use of a personal firewall, or by disabling NetBIOS over TCP/IP. SecurityFocus BID 4532 details disabling NetBIOS over TCP/IP.

2. Create and set the MaxWorkItems value in the registry to a value that the computer can support. Refer to the Microsoft KB Article 320751 for specific steps to creating the MaxWorkItems registry value.

• Security Tracker: 1004083
• CVE ID: 2002-0597 (see also: NVD)
• Bugtraq ID: 4532
• CERT VU: 693099
• ISS X-Force ID: 8867
• Other Advisory URL: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0025.html
• Vendor Specific Solution URL: http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/default.asp
• Keyword: KPMG-2002011 TCP Port 445
• Microsoft Knowledge Base Article: Q320751

• Peter Gründl - peter.grundldefcom.com - Defcom Labs