| VID |
28016 |
| Severity |
20 |
| Port |
139 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The Alerter service was found to be running on the target host. The Windows Alerter service lets a user send pop-up messages to other users.
A network administrator may consider this ability as an unnecessary risk because these types of services have been used in social engineering attacks. Some users may respond to a request to change their password, create a share, or otherwise open holes in the network. A side effect of running this service is that it causes the current username to be broadcasted in the NetBIOS name table, giving an attacker a valid username to use in brute force attempts.
* Note: This check requires an account with Guest or upper privileges which can log into the host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://www.iss.net/security_center/static/29.php
* Platforms Affected:
Microsoft Windows NT, 2000, XP, 2003 |
| Recommendation |
Disable the Alerter service.
To stop or disable the service in Windows NT:
1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Service.
2. Select the 'Alerter' service.
3. Click Stop.
4. When the service has stopped, click Startup, and choose one of these options:
o To permanently disable the service, click Disabled.
o To turn the service off unless manually activated by the user or a program, click Manual.
5. Click OK, then click Close.
To stop or disable the service in Windows 2000:
1. Open the Control Panel. (Go to Start menu, Settings, and select Control Panel.)
2. Double-click Administration Tools.
3. Double-click Services.
4. Double-click the 'Alerter' service.
5. To stop the service, click the Stop button. To permanently disable the service, click the Startup type button and select Disabled.
6. Click OK to save the settings.
To stop or disable the service in Windows XP, 2003:
1. Go to Start menu -> Run and Type 'services.msc'
2. Double-click the 'Alerter' service.
3. To stop the service, click the Stop button. To permanently disable the service, click the Startup type button and select Disabled.
4. Click OK to save the settings. |
| Related URL |
CVE-1999-0621 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
