{"vuid":"VU#887393","idnumber":"887393","name":"Microsoft Windows 2000 SNMP service leaks memory when querying printer objects if spooler service is stopped","keywords":["Microsoft","Windows 2000","SNMP","leak memory","querying printer objects","spooler service","Q296815"],"overview":"A memory leak exists in the Windows 2000 SNMP service. Under a specific precondition, it can result in a remote denial-of-service vulnerability.","clean_desc":"If the SNMP service is running on a Windows 2000 server, and the 'Print Spooler' service is not running, repeatedly using SNMP queries to obtain print queue related values in the LANMAN MIB will cause the SNMP service to consume very large amounts of memory. According to the NGS Software advisory, approximately 30MB of memory is allocated per SNMP request received. Multiple SNMP queries sent in short succession can readily consume all available memory on vulnerable systems. For additional information, see the NGS Software advisory and the Microsoft Knowledge Base Article.","impact":"The Windows 2000 server can be caused to crash when all available memory is exhausted, resulting in a denial of service condition.","resolution":"Microsoft has addressed this vulnerability in Windows 2000 service pack 3 (SP3).","workarounds":"Workarounds If you cannot upgrade to Windows 2000 SP3, the following steps may help to limit your exposure: Disable the SNMP service on systems that do not require it. Change community names from their default values. 'public' is commonly used for the read-only community name and 'private' is commonly used for the read-write name. Permit SNMP queries from only authorized network managment stations using the 'Services' management snap-in. Filter queries from all other sources using a simple packet filter or an IPsec policy. In general, we recommend a conservative, minimalist approach to network configuration. Therefore, these steps are recommended even for systems running SP3.","sysaffected":"","thanks":"Thanks to Chris Anley for reporting this vulnerability.","author":"This document was written by Chad R Dougherty.","public":["http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296815","http://www.ngssoftware.com/advisories/snmp_dos.txt","http://www.securityfocus.com/bid/6030"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-10-23T13:58:37Z","publicdate":"2001-04-20T00:00:00Z","datefirstpublished":"2002-10-24T20:01:24Z","dateupdated":"2002-11-07T15:51:59Z","revision":20,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"4","cam_population":"13","cam_impact":"7","cam_easeofexploitation":"10","cam_attackeraccessrequired":"15","cam_scorecurrent":"4.8628125","cam_scorecurrentwidelyknown":"6.1425","cam_scorecurrentwidelyknownexploited":"11.26125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":4.8628125,"vulnote":null}