COMMAND
NNTP
SYSTEMS AFFECTED
NNTP
PROBLEM
Following is based on a Microsoft Security Bulletin MS01-043. The
NNTP (Network News Transport Protocol) service in Windows NT 4.0
and Windows 2000 contains a memory leak in a routine that
processes news postings. Each time such a posting is processed
that contains a particular construction, the memory leak causes a
small amount of memory to no longer be available for use. If an
attacker sent a large number of posts, the server memory could be
depleted to the point at which normal service would be disrupted.
An affected server could be restored to normal service by
rebooting.
Windows NT 4.0 does not contain a native NNTP service. NNTP
is only available on the system if the Windows NT 4.0 Option
Pack has been installed. The default configuration of NNTP is
not affected by the vulnerability, as no newsgroups are configured
by default.
The vulnerability would not enable an attacker to usurp any
administrative control or compromise data on the machine.
Acknowledgment goes to Aiden ORawe.
SOLUTION
A patch is available to fix this vulnerability. Please read the
Security Bulletin
http://www.microsoft.com/technet/security/bulletin/ms01-043.asp
for information on obtaining this patch.
Credits
-- UnKnown --
|