CVE-2000-0673 (NetBIOS Name Spoofing) Vulnerability: Analysis & Mitigation

A newly disclosed flaw can hand an attacker the ability to run their own code on systems running NetBIOS Name Spoofing -- not a minor bug, the kind that gets full control.

The affected service is reachable from the network without authentication.

NetBIOS Name Spoofing may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.

The vulnerability was publicly disclosed on July 27, 2000.

It was addressed by Microsoft in Security Bulletin MS00-047, released the same day.

If another machine claims that name, it sends a negative response, and the new machine backs off.

Anyone running NetBIOS Name Spoofing rely on DNS and are secure against this specific spoofing technique by default configuration is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.

CVE-2000-0673 is a classic Denial of Service (DoS) vulnerability affecting the NetBIOS Name Server (NBNS) protocol in older versions of Microsoft Windows (Windows 2000 and NT 4.0).

CVE-2000-0673 is a NetBIOS Name Server Protocol Spoofing vulnerability.

What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.

Being reachable without authentication is what moves this from 'patch eventually' to 'patch now' -- there's no login screen standing between an attacker and the vulnerable code.

It allows a remote attacker to force a computer to drop its network name, effectively disconnecting it from local network services like file sharing and printing.

This is tracked as CVE-2000-0673 and rated critical severity, which is the identifier to use when checking vendor guidance.

The affected versions are rely on DNS and are secure against this specific spoofing technique by default configuration, so that's the range to check against your own deployment.

While this vulnerability is over two decades old, it highlights a fundamental flaw in early network protocols: the lack of authentication.

This page details the mechanics of this protocol abuse, its historical significance, and why blocking NetBIOS remains a critical security practice today.

The flaw exists because the protocol accepts specific management packets—specifically Name Conflict or Name Release datagrams—without verifying the identity of the sender.

In response, the victim machine dutifully releases its name and stops responding to network requests, causing a Denial of Service.

Confirm whether NetBIOS Name Spoofing rely on DNS and are secure against this specific spoofing technique by default configuration is present anywhere in your asset and software inventory.

No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.

OS Fingerprinting: Vulnerability scanners will flag Windows 2000 or NT 4.0 systems that are missing the MS00-047 patch (though these systems are End-of-Life and universally vulnerable to newer exploits).