News

Elevation of Privilege Flaw in Windows 2000

Microsoft warned users of an important new flaw in Windows 2000.

A hacker could use an elaborate process to elevate his or her privileges through a security problem in the Network Connection Manager (NCM) within Windows 2000, Microsoft warned in a bulletin late last week. The flaw rates as a critical vulnerability for client systems and intranet systems, although it is low risk for Internet systems, Microsoft says.

Each time a network connection is established, NCM calls a handler routine that is supposed to run in the security context of the user. The flaw makes it possible for an unprivileged user to cause the handler routine to execute in the security context of LocalSystem.

An attacker who successfully exploits the flaw could supply code to be run as the handler, and establish a network connection to cause NCM to invoke the code, which would run with full system privileges, according to Microsoft's documentation.

To exploit the flaw, an attacker must have credentials to log onto an affected system. As a mitigating factor, Microsoft points out that best practices discourage allowing interactive log on for unprivileged users on business-critical servers, such as domain controllers, ERP servers and database servers. A patch is available to fix the problem.

The security bulletin dealing with the critical flaw, MS02-042, and its associated patch, can be found here:
www.microsoft.com/technet/security/bulletin/MS02-042.asp.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Previews Windows Autopilot for HoloLens 2

    Microsoft on Friday announced a public preview of Windows Autopilot for HoloLens 2, its mixed-reality headset.

  • Microsoft Flirts with Charging for API Software Connections

    Microsoft may have started something new by attempting to charge its customers for software that uses its application programming interfaces (APIs).

  • Overcoming Spacesuit Anxiety During Astronaut Training

    Spacesuits are heavy, claustrophobic and hot -- an uncomfortable combination for many would-be astronauts. Here's how Brien came around to the idea of wearing one.

  • Microsoft Announces Azure Kubernetes Service Enhancements

    Microsoft this week announced a few Azure Kubernetes Service (AKS) product milestones as part of the KubeCon event.

comments powered by Disqus