Security

Ask something
Discussion Locked

Unpassworded NetBIOS/SMB vulnerability

0 helpful
3 replies

by gris20

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

When I ran a security checker on our network, I received the following warning:
-------------------
Vulnerability Group: SMB/NetBIOS Resource Sharing
Vulnerability: Unpassworded NetBIOS/SMB check
Description: Service Message Block (SMB) is the standard resource-sharing protocol used by Windows platforms. The SMB protocol is transmitted using NetBIOS, a networking protocol designed to allow groups of PCs to interoperate. NetBIOS is accessible over TCP/IP using the NBT protocol. SMB resource sharing makes use of two different security models, "share-level" and "user-level". In share-level security, groups of files (directory trees) are protected by a password, allowing simple workgroups to be configured simply by ensuring that they share a password. In user-level security, all attempts to access resources are authenticated with a username and password. It is possible to obtain a list of shares offered by an SMB-speaking computer by initiating an SMB session with no username or password (this is referred to as a "null session"). The information available from this transaction can be used by an attacker to conduct further attacks.
Security Concerns: N/A
Scan Details: Was able to connect with no username or password
------------------------
My Question is how do I correct this?

3 replies

by stillatit

What this means is that somewhere on your network there is a Windows 95 or 98 box which is sharing a directory or disk, where the share does not specify a password. If you are not running a domain, this is a common way for users to share some files.

You can correct this in a number of ways, depending on your level of paranoia:

1. If there is no need for anyone outside your network to access network shares, and you WANT unprotected shares within your network, block the netbios protocol numbers at the firewall. These are:
netbios-dgm 138/udp nbdatagram #NETBIOS Datagram Service
netbios-ssn 139/tcp nbsession #NETBIOS Session Service

2. If you do not want or need unprotected shares within your network, track down the shares, and insist that the users apply passwords to the shares. You can find the shares by opening network neighborhood, then opening each computer in turn, looking for shares.

3. If you have a domain (NT server or W2Kserver running as a domain controller), then you can change all of the W95 and W98 boxes so that they validate access to their shares using the domain. To do this, in the System control panel of each machine, look for the tab that lets you select between Share-level and User-level security. Change to User-level, and specify the domain. In this mode, permissions to the share are granted to specific users and groups, rather than to anyone who knows the share name (and password if any).

Good luck.

This discussion is closed to new replies.