Follow-Up: Security Problems with Linux 2.2.x IP Masquerading

[hdm () SECUREAUSTIN COM (H D Moore)]

Following the "NetBIOS Info" thread on Incidents mailing list at SF,
Robert Graham <bugtraq () NETWORKICE COM> mentioned a utility he wrote to
automatically respond to netbios port 137 name probes with a netbios
name lookup back to the originating host.  He mentioned that it seems to
cut right through state-based firewalls and NAT systems because the
response probe looks like a response to the outgoing probe.  Assuming
that a host on an inside network is sending out these netbios name
queries (1), an attacker could exploit the linux 2.2.x vulnerability and
be able to query the netbios names of internal machines.

-HD

1: http://www.robertgraham.com/pubs/firewall-seen.html#netbios