Re: NetBIOS Name Accessible

[Charles Wilt <charles.wilt@xxxxxxxxx>]

I'd say that's NETSERVER running...

Don't know that it can be changed without turning off NETSERVER.

Charles

On Wed, Feb 16, 2011 at 2:55 PM,  <rob@xxxxxxxxx> wrote:
> We've contracted with IBM to perform some threat analysis of our network.
> We get these qualsys reports of our vulnerabilities.
> One vulnerability is NetBIOS Name Accessible.
>
> Is NetBIOS really on our i?  Should we shut it down?  If so, how do we do
> that?
>
> Details of threat are below:
>
> Level 2 NetBIOS Name Accessible
> QID: 70000
> Category: SMB / NETBIOS
> CVE ID: -
> Vendor Reference: -
> Bugtraq ID: -
> Service Modified: 04/28/2009
> User Modified: -
> Edited: No
> THREAT:
> Unauthorized users can obtain this host's NetBIOS server name from a
> remote system.
> IMPACT:
> Unauthorized users can obtain the list of NetBIOS servers on your network.
> This list outlines trust relationships between server and client
> computers. Unauthorized users can therefore use a vulnerable host to
> penetrate secure servers.
> SOLUTION:
> If the NetBIOS service is not required on this host, disable it.
> Otherwise, block any NetBIOS traffic at your network boundaries.
> COMPLIANCE:
> Not Applicable
> EXPLOITABILITY:
> There is no exploitability information for this vulnerability.
> ASSOCIATED MALWARE:
> There is no malware information for this vulnerability.
> RESULTS:
> GDWEB
>
>
>
> Rob Berendt
> --
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>          Garrett, IN 46738
> Ship to:  Dock 108
>          6928N 400E
>          Kendallville, IN 46755
> http://www.dekko.com
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.