Port Details - Port 139

Oct 24 1,385 Oct 25 1,456 Oct 26 1,668 Oct 27 1,897 Oct 28 1,728 Oct 29 1,485 Oct 30 1,573 Oct 31 1,395 Nov 01 1,319 Nov 02 1,424 Nov 03 1,513 Nov 04 1,833 Nov 05 1,689 Nov 06 1,637 Nov 07 1,547 Nov 08 1,489 Nov 09 1,620 Nov 10 1,599 Nov 11 1,524 Nov 12 1,459 Nov 13 1,478 Nov 14 1,476 Nov 15 2,255 Nov 16 2,573 Nov 17 2,623 Nov 18 2,544 Nov 19 2,490 Nov 20 2,491 Nov 21 2,544 Nov 22 471 Oct 24 50,951 Oct 25 70,976 Oct 26 16,505 Oct 27 16,907 Oct 28 17,178 Oct 29 18,798 Oct 30 16,475 Oct 31 15,770 Nov 01 16,473 Nov 02 17,681 Nov 03 19,822 Nov 04 45,031 Nov 05 15,941 Nov 06 19,957 Nov 07 17,010 Nov 08 16,784 Nov 09 18,920 Nov 10 16,122 Nov 11 17,171 Nov 12 16,062 Nov 13 46,793 Nov 14 64,470 Nov 15 15,777 Nov 16 19,834 Nov 17 19,158 Nov 18 20,355 Nov 19 19,591 Nov 20 69,631 Nov 21 19,871 Nov 22 5,623
[show ascii data]
  • Start Date:
  • End Date:
  • Port:
  • Left Graph:
  • Right Graph:
  • Show Range:Yes No

Port Information

ProtocolServiceName
udpnetbios-ssnNETBIOS Session Service
tcpnetbios-ssnNETBIOS Session Service
tcpSMBRelay[trojan] SMB Relay
tcpSadmind[trojan] Sadmind
tcpQaz[trojan] Qaz
tcpNetwork[trojan] Network
tcpNetlog[trojan] Netlog
tcpMsinit[trojan] Msinit
tcpGodMessageworm[trojan] God Message worm
tcpChode[trojan] Chode
[get complete service list]

User Comment

Submitted ByDate
Comment
Marcus H. Sachs, SANS Institute2003-10-10 00:35:06
SANS Top-20 Entry: W5 Windows Remote Access Services http://isc.sans.org/top20.html#w5 NETBIOS -- Unprotected Windows Networking Shares Microsoft Windows provides a host machine with the ability to share files or folders across a network with other hosts through Windows network shares. The underlying mechanism of this feature is the Server Message Block (SMB) protocol, or the Common Internet File System (CIFS). These protocols permit a host to manipulate remote files just as if they were local. Although this is a powerful and useful feature of Windows, improper configuration of network shares may expose critical system files or may provide a mechanism for a nefarious user or program to take full control of the host. One of the ways in which I-Worm.Klez.a-h (Klez Family) worm, Sircam virus (see CERT Advisory 2001-22) and Nimda worm (see CERT Advisory 2001-26) spread so rapidly in 2001 was by discovering unprotected network shares and placing copies of themselves in them. Many computer owners unknowingly open their systems to hackers when they try to improve convenience for co-workers and outside researchers by making their drives readable and writeable by network users. But when care is taken to ensure proper configuration of network shares, the risks of compromise can be adequately mitigated.
Add a comment

CVE Links

CVE #Description
CVE-1999-182 "Samba has a buffer overflow which allows a remote attacker to obtain root access by specifying a long password."
CVE-2000-347 "Windows 95 and Windows 98 allow a remote attacker to cause a denial of service via a NetBIOS session request packet with a NULL source name."
CVE-2000-1081 "The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2000-1082 "The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2000-1083 "The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2000-1084 "The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2000-1085 "The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2000-1086 "The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2000-1087 "The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2000-1088 "The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP)
CVE-2001-542 "Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror
CVE-2002-642 "The registry key containing the SQL Server service account information in Microsoft SQL Server 2000
CVE-2002-724 "Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT
CVE-2003-201 "Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a
CVE-2003-533 "Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a
CVE-2003-812 "Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file (""NetSetup.LOG"")
CVE-2003-813 "A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request
CVE-2003-818 "Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL)
CVE-2004-1154 "Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow."