Qualys showing "Null Session/Password NetBIOS Access" on DCs - Not Sure How/If this can be fixed.

greetings,

our area uses qualys vulnerability scanning , our dcs showing following vulnerabilities:

remote user list disclosure using netbios (7)
qid: 45003
category: information gathering
cve id: cve-2000-1200
vendor reference: -
bugtraq id: 959
modified: 10/08/2009
edited: no

null session/password netbios access (7)
qid: 70003
category: smb / netbios
cve id: cve-1999-0519
vendor reference: -
bugtraq id: -
modified: 10/08/

basically, appears anonymous users can generate list of domain user names , exploited via brute force attacks.   i’ve followed of steps below in ms articles listed below:

 

“it recommended disable null sessions.

before editing configuration file in production environment, changes should tested in rehearsal environment.

read microsoft documents called how use restrictanonymous registry value (http://support.microsoft.com/default.aspx?scid=kb;en-us;246261) and

restricting anonymous access (http://technet2.microsoft.com/windowsserver/en/library/2c82586e-bd58-42b7-9976-228a23721e351033.mspx?mfr=true) for

more information. if vulnerability discovered on domain controller, please note of recommended settings may not have effect. read

the microsoft article description of dcpromo permissions choices (http://support.microsoft.com/kb/257988/) more information regarding pre-windows 2000

compatible access.”

 

the thing haven’t done set restrictnullsessaccess key in hklm\system\currentcontrolset\services\lanmanserver\parameters setting (2).  it set (1)  limits not null sessions.

 

the kicker our test domain configured same way , doesn’t show on scan having these vulnerabilities?  has seen before?  our domain admins worried making change (rightly so) because think must need way , don’t want break domain.  i can’t recreate issue on test domain try fix.  security telling has fixed now! , i’m not sure can do.  any appreciated.  thanks.

i have never gotten locked down.  basically, if on network, going able poke around , use freeware scanning tools , see network.  pursuing perfection going strenuous task , result in great expense, can closely achieved...

the mitigation strategies center little around have , security practices around managing , securing ad, focus more on:

encryption – implementing pki , forcing ipsec on machines aid in fight.  port scanners can still detect port usage , able deduce information domain, if force machines encrypt network traffic, there less in terms of carte blanche response servers on network.

physical security of network – don’t let people in buildings unless supposed there.

perimeter defense – use technologies microsoft’s uag (isa , iag) , cisco pix defend external network access points , technologies similar rsa or uag secure vpn access.

logical network defense – use tools nap isolate “non-ideal” entities on physical network verify identity, antivirus , malware status.

good luck,

 

 

---

aaron sankey, avanade

Windows Server  >  Directory Services