How to remediate – Windows NetBIOS / SMB Remote Host Information Disclosure

1. Introduction

The Windows NetBIOS / SMB Remote Host Information Disclosure vulnerability allows an attacker to obtain the network name of a remote host. This information can be used for reconnaissance, mapping out a network and identifying potential targets for further attacks. Systems running Windows operating systems with enabled NetBIOS or SMB services are usually affected. Impact on confidentiality is likely, integrity and availability are less directly impacted.

2. Technical Explanation

The remote host responds to NetBIOS nbtscan or SMB requests over UDP port 137 or TCP port 445. This means the system is advertising its presence on the network. An attacker can send these requests and receive a response containing the hostname. There isn’t a specific CVE associated with this information gathering, but it’s often identified during vulnerability scans as an initial step in broader exploitation attempts.

• Root cause: The NetBIOS or SMB service is enabled and configured to respond to broadcast queries.
• Exploit mechanism: An attacker uses tools like nbtscan to send a request to the network, receiving a response with the hostname of vulnerable systems. For example, an attacker could use nbtscan 192.168.1.0/24 to scan a subnet for NetBIOS-enabled hosts.
• Scope: Windows operating systems including Server and Desktop editions are affected when these services are active.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking whether the NetBIOS or SMB service is listening on UDP port 137 or TCP port 445. A thorough method involves running a network scan.

• Quick checks: Use netstat -an | findstr /I "137" and netstat -an | findstr /I "445" to see if ports are listening.
• Scanning: Nessus plugin ID 8269 or OpenVAS scan config ‘SMB NetBIOS Information Disclosure’ can identify this issue, but these are examples only.
• Logs and evidence: Windows event logs do not typically record information about responding to nbtscan requests directly. Network traffic analysis may show SMB/NetBIOS packets being sent and received.

netstat -an | findstr /I "445"

4. Solution / Remediation Steps

The best way to fix this issue is to disable NetBIOS over TCP/IP if it’s not required, or restrict access to SMB services.

4.1 Preparation

• Ensure you have administrative credentials and understand the impact of disabling NetBIOS/SMB on network connectivity. Roll back by re-enabling the services or restoring the snapshot.
• A change window may be needed, depending on business requirements. Approval from a senior IT administrator is recommended.

4.2 Implementation

1. Step 1: Disable NetBIOS over TCP/IP by running netsh interface ip set netbios enabled=no in an elevated command prompt.
2. Step 2: Restart the system for the changes to take effect.
3. Step 3: If disabling SMB entirely, stop and disable the ‘Server’ service via services.msc.

4.3 Config or Code Example

Before

netsh interface ip show netbios

After

netsh interface ip show netbios

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege reduces the impact if SMB is exploited. Network segmentation limits exposure. Patch cadence ensures systems are up-to-date with security fixes.

• Practice 1: Implement least privilege principles, limiting access to SMB shares and services only to authorized users.
• Practice 2: Segment your network to isolate sensitive systems from less trusted networks.

4.5 Automation (Optional)

# PowerShell example to disable NetBIOS on all interfaces
Get-NetAdapter | ForEach-Object {
  Disable-NetAdapterBinding -Name $_.Name -ComponentID ms_netbios
}

5. Verification / Validation

Confirm the fix by checking that NetBIOS is disabled and SMB services are no longer responding to requests. Run a service smoke test to ensure core functionality remains.

• Post-fix check: Run netsh interface ip show netbios. Expected output should show “NetBIOS over TCP/IP Enabled : No”.
• Re-test: Re-run the netstat -an | findstr /I "137" and netstat -an | findstr /I "445" commands to confirm ports are no longer listening.
• Smoke test: Verify file sharing or printer access is still working if SMB is required for business functions.
• Monitoring: Monitor network traffic for unexpected SMB/NetBIOS activity using a packet capture tool as an example.

netsh interface ip show netbios

6. Preventive Measures and Monitoring

Update security baselines to include disabling NetBIOS over TCP/IP where possible. Implement regular patch cycles to address known vulnerabilities in SMB services. For example, use Group Policy or Intune to enforce these settings.

• Baselines: Update your Windows security baseline to disable NetBIOS over TCP/IP by default.
• Pipelines: Include checks for unnecessary SMB service exposure in your CI/CD pipeline.
• Asset and patch process: Implement a monthly patch cycle for all Windows systems, including regular vulnerability scans.

7. Risks, Side Effects, and Roll Back

Disabling NetBIOS or SMB can break legacy applications that rely on these protocols. Service impacts may occur if file sharing or printer access is affected. Roll back by re-enabling NetBIOS with netsh interface ip set netbios enabled=yes or starting the ‘Server’ service.

• Risk or side effect 2: Users may be unable to access shared files or printers if SMB is disabled. Mitigation: Communicate changes and provide alternative solutions.
• Roll back: Step 1: Re-enable NetBIOS with netsh interface ip set netbios enabled=yes. Step 2: Start the ‘Server’ service via services.msc. Step 3: Restart the system.

8. References and Resources

• Vendor advisory or bulletin: Microsoft NetBIOS over TCP
• NVD or CVE entry: No specific CVE for this information disclosure, but see related SMB vulnerabilities on the NVD website (https://nvd.nist.gov/).
• Product or platform documentation relevant to the fix: Configuring NetBIOS over TCP/IP