Microsoft Windows 95 NetBIOS/SMB Share improper authentication

Summaryinfo

A vulnerability was found in Microsoft Windows 95. It has been classified as critical. The impacted element is an unknown function of the component NetBIOS/SMB Share. The manipulation leads to improper authentication. This vulnerability is listed as CVE-1999-0518. The attack may be initiated remotely. In addition, an exploit is available. Due to its background and reception, this vulnerability has an historic impact. It is recommended to add further authentication.

Detailsinfo

A vulnerability was found in Microsoft Windows 95 (Operating System). It has been rated as critical. This issue affects an unknown code block of the component NetBIOS/SMB Share. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

a netbios/smb share password is guessable.

The issue has been introduced in 08/24/1995. The weakness was presented 01/01/1997. The identification of this vulnerability is CVE-1999-0518. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/23/2018). Due to its background and reception, this vulnerability has a historic impact.

It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 496 days. During that time the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 10909 , which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 5005 (NetBIOS Brute Force of Accounts).

Upgrading to version 98, NT 4.0 or 2000 eliminates this vulnerability. It is possible to mitigate the problem by adding an authentication mechanism. The best possible mitigation is suggested to be adding authentication.

The vulnerability is also documented in the databases at X-Force (469), Tenable (10909) and Vulnerability Center (SBV-667†). See VDB-13819, VDB-14231 and VDB-14232 for similar entries. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 95

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion