Microsoft Windows 9x NETBIOS password verification vulnerability
7 Sep. 2000
Summary
A vulnerability exists in the password verification scheme utilized by Microsoft Windows 9x NETBIOS protocol implementation. This vulnerability will allow any user to access the Windows 9x file shared service with password protection. Potential attackers don't have to know the share password.
Vulnerable systems:
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition
Immune systems:
- Windows NT 4.0
- Windows 2000
Anyone can set a password to protect Microsoft Windows 9x system's shared resources. But a vulnerability in the password verification scheme can be used to bypass this protection. To verify the password, the length of the password depends on the length of the data sent from client to server. That is, if a client sets the length of password to a 1 byte and sends the packet to server, the server will only compare the first byte of the shared password, and if there is a match, the authentication will be complete (the user will be granted access). So, all an attacker need to do is to guess and try the first byte of password in the victim. Windows 9x remote management system is also affected since it adopts the same share password authentication method.
Exploit:
Here is one simple example to demonstrate this bug. Get samba source package and modify source/client/client.c like this:
