TITLE:
Windows Anonymous Named Pipe Connection Information Disclosure

SECUNIA ADVISORY ID:
SA14189

VERIFY ADVISORY:
http://secunia.com/advisories/14189/

CRITICAL:
Not critical

IMPACT:
Exposure of system information

WHERE:
>From local network

OPERATING SYSTEM:
Microsoft Windows XP Professional
http://secunia.com/product/22/
Microsoft Windows XP Home Edition
http://secunia.com/product/16/

DESCRIPTION:
Jean-Baptiste Marchand has reported a weakness in Microsoft Windows
XP, which can be exploited by malicious people to gain knowledge of
certain system information.

The weakness is caused due to an unspecified error in the process
used for validating authentication information when clients establish
anonymous logons using named pipe connections.

Successful exploitation discloses the usernames of users with an open
connection to an available shared resource.

SOLUTION:
Apply patches.

Windows XP (requires Service Pack 1 or Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=B8C867C2-B7CD-4E2F-90E0-169B2C7125DC

Windows XP 64-Bit Edition (requires Service Pack 1 (Itanium)):
http://www.microsoft.com/downloads/details.aspx?FamilyId=2F68945E-EEB8-42BC-A8AD-0D3991204889

PROVIDED AND/OR DISCOVERED BY:
Jean-Baptiste Marchand, Herve Schauer Consultants.

ORIGINAL ADVISORY:
MS05-007 (KB888302):
http://www.microsoft.com/technet/security/bulletin/ms05-007.mspx

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------