Microsoft Windows NT 4.0 RAS Administration Registry Key Vulnerability

Bugtraq ID:	2064
Class:	Access Validation Error
CVE:	CVE-2001-0045
Remote:	No
Local:	Yes
Published:	Dec 06 2000 12:00AM
Updated:	Jul 11 2009 03:56AM
Credit:	Discovered by Milan Dadok and publicized in a Microsoft Security Bulletin (MS00-095) on December 6, 2000.
Vulnerable:	Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0
Not Vulnerable:

Microsoft Windows NT 4.0 RAS Administration Registry Key Vulnerability

Solution:
Microsoft has released the following tool which corrects the registry key value (this tool also corrects the registry values for other vulnerabilities discussed in Microsoft Security Bulletin MS00-095). Please see Frequently Asked Questions (Microsoft Security Bulletin MS00-095) under "Credit" for details in regards to proper usage of the tool:


Microsoft Windows NT Terminal Server 4.0

• Microsoft Q265714
  http://download.microsoft.com/download/winntsp/Patch/Q266794/NT4/EN-US /Q265714i.EXE

Microsoft Windows NT 4.0

• Microsoft Q265714
  http://download.microsoft.com/download/winntsp/Patch/Q266794/NT4/EN-US /Q265714i.EXE

Microsoft Windows NT 4.0 RAS Administration Registry Key Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-095) (Microsoft)