According to a bulletin published on Microsofts Web site, “The NNTP (Network News Transport Protocol) service in Windows NT 4.0 and Windows 2000 contains a memory leak in a routine that processes news postings. Each time such a posting is processed that contains a particular construction, the memory leak causes a small amount of memory to no longer be available for use. If an attacker sent a large number of posts, the server memory could be depleted to the point at which normal service would be disrupted. An affected server could be restored to normal service by rebooting.”
The company said the security vulnerability can potentially cause denial of service. According to Microsoft, “The vulnerability would not enable an attacker to compromise any data on the server, or to usurp any privileges on the machine.”
The patches are available here.
System administrators should note that Windows NT 4.0 does not contain a native NNTP service. NNTP is only available on the system if the Windows NT 4.0 Option Pack has been installed. Microsoft recommends that the patch be applied immediately to prevent any denial of service attacks.