BID:1507

Microsoft Windows NT 4.0 / 2000 Unspecified Executable Path Vulnerability

Info

Microsoft Windows NT 4.0 / 2000 Unspecified Executable Path Vulnerability

Bugtraq ID:	1507
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 25 2000 12:00AM
Updated:	Jul 25 2000 12:00AM
Credit:	Discovered by Alberto Aragones <[email protected]> on July 26, 2000.
Vulnerable:	Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows NT 4.0 / 2000 Unspecified Executable Path Vulnerability

When executables and DLL files are not preceded by a path in the registry (eg. explorer.exe does not have a fixed path by default), Windows NT 4.0 / 2000 will search for the file in the following locations in this order:

1) The directory from which the application loaded.
2) The current directory of the parent process
3) ...\System32
4) ...\\System
5) The Windows directory
6) The directories specified in the PATH environment variable

This may open up the possibility of automatic execution of trojans if they are renamed as executables that do not have a path specified. If we use the example of explorer.exe, a trojan named as such could be written to the root directory. Whenever a user logs onto the system, the trojan would be opened automatically.

Remote exploitation is feasible if the root directory is accessible through a share or if a malicious user were to implant the trojan onto the root directory through other means.

Exploit / POC

Microsoft Windows NT 4.0 / 2000 Unspecified Executable Path Vulnerability

The Quimeras Company <[email protected]> has set up an exploit demonstration on the bottom of the following URL:

http://www.quimeras.com/secadv/ntpath.htm

Solution / Fix

Microsoft Windows NT 4.0 / 2000 Unspecified Executable Path Vulnerability

Solution:
Microsoft has released the following patches which eliminates the vulnerability:

Microsoft Windows NT Enterprise Server 4.0