Elevation of Privilege Flaw in Windows 2000 -- Redmondmag.com

Elevation of Privilege Flaw in Windows 2000

By Scott Bekker
08/20/2002

Microsoft warned users of an important new flaw in Windows 2000.

A hacker could use an elaborate process to elevate his or her privileges through a security problem in the Network Connection Manager (NCM) within Windows 2000, Microsoft warned in a bulletin late last week. The flaw rates as a critical vulnerability for client systems and intranet systems, although it is low risk for Internet systems, Microsoft says.

Each time a network connection is established, NCM calls a handler routine that is supposed to run in the security context of the user. The flaw makes it possible for an unprivileged user to cause the handler routine to execute in the security context of LocalSystem.

An attacker who successfully exploits the flaw could supply code to be run as the handler, and establish a network connection to cause NCM to invoke the code, which would run with full system privileges, according to Microsoft's documentation.

To exploit the flaw, an attacker must have credentials to log onto an affected system. As a mitigating factor, Microsoft points out that best practices discourage allowing interactive log on for unprivileged users on business-critical servers, such as domain controllers, ERP servers and database servers. A patch is available to fix the problem.

The security bulletin dealing with the critical flaw, MS02-042, and its associated patch, can be found here:
www.microsoft.com/technet/security/bulletin/MS02-042.asp.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.
Fallout from Microsoft's 'Midnight Blizzard' Saga Hits Feds

When the Russian attack group Midnight Blizzard successfully breached Microsoft corporate e-mail accounts late last year, it apparently managed to steal U.S. government agency e-mails, too.
PowerShell Script Used in Phishing Attack May Be AI-Generated

A PowerShell script being used in a novel malware campaign may have been created by AI, according to security researchers at Proofpoint.
Using Microsoft Office to Build a Network Diagram, Part 1

Keeping documentation is a great way to ease your future hardware refresh and have what you need for insurance purposes.
Microsoft Claims Breakthrough in Quantum Computing Reliability

A new paper details Microsoft's recent progress in quantum computing -- specifically, its development of a system that is both significantly less prone to errors and better at correcting them.