Windows 2000 Active Directory Object Attribute Vulnerability

Bugtraq ID:	1145
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 20 2000 12:00AM
Updated:	Apr 20 2000 12:00AM
Credit:	Discovered by Sebastien Malbois <[email protected]> and publicized in a Microsoft Security Bulletin (MS00-026) on April 20, 2000.
Vulnerable:	Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Advanced Server
Not Vulnerable:

Windows 2000 Active Directory Object Attribute Vulnerability

Under special circumstances, local users in Windows 2000 are able to modify attributes of an object in the Active Directory even though they do not possess the rights to do so.

If the local user has write permission to one attribute of an Active Directory object, they will be able to write to other attributes. This activity will be logged.

This vulnerability only affects servers that are domain controllers.

Windows 2000 Active Directory Object Attribute Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] .

Windows 2000 Active Directory Object Attribute Vulnerability

Solution:
Patches available:


Microsoft Windows 2000 Advanced Server

• Microsoft Q259401
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=20520

Microsoft Windows 2000 Server

• Microsoft Q259401
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=20520

Windows 2000 Active Directory Object Attribute Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-026) (Microsoft)
  
• Q259401: Active Directory Objects May Be Modified Programmatically (Microsoft)