News

Microsoft Warns of W2K Bug

Microsoft Corp. has released a patch that eliminates a security vulnerability in Windows 2000. The vulnerability could allow a malicious user to disrupt normal operation of an affected machine, and potentially of an entire network.

Microsoft users who have already applied Windows 2000 Service Pack 1 are protected against the vulnerability and do not need to take further action.

The vulnerability could allow a malicious user to corrupt parts of a Windows 2000 system's local security policy, with the effect of disrupting domain membership and trust relationship information. If a workstation or member server were attacked via this vulnerability, it would effectively remove the machine from the domain; if a domain controller were attacked, it could no longer process domain logon requests. Recovering from such an attack would likely require that a known working configuration be restored from backup.

It would not be necessary to be an authenticated domain member in order to mount an attack in this manner. Any user who could establish an RPC connection with an affected machine and send the proper command sequence to it could exploit the vulnerability. If the malicious user were an intranet user, he could likely attack any machine within the network; if the malicious user were on the Internet, he could likely only attack machines on the network edge that allow RPC connections.

Microsoft Windows 2000 Professional, Server, and Advanced Server are all affected. The patch is available at http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24019. - Isaac Slepner

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Populating a SharePoint Document Library by E-Mail, Part 1

    While Microsoft doesn't allow you to build a SharePoint Online document library using e-mail, there is a roundabout way of getting the job done using the tools that are included with Office 365. Brien shows you how.

  • Microsoft Previews New App Reporting and Consent Tools in Azure AD

    Microsoft last week described a few Azure Active Directory improvements for organizations wanting to connect their applications to Microsoft's identity and access service.

  • Free Software Foundation Asks Microsoft To Release Windows 7 Code

    The Free Software Foundation this week announced that it has established a petition demanding that Microsoft release its proprietary Windows 7 code as free software.

  • Managing Multiple Remote Connections in One Place with mRemoteNG

    If you're juggling multiple remote connections daily, this is the utility for you. Brien walks through the steps to use mRemoteNG, from installation to deployment.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.