BID:2849

Microsoft Windows 2000 Telnet Privilege Escalation Vulnerability

Info

Microsoft Windows 2000 Telnet Privilege Escalation Vulnerability

Bugtraq ID:	2849
Class:	Access Validation Error
CVE:	CVE-2001-0349
Remote:	Yes
Local:	No
Published:	Jun 08 2001 12:00AM
Updated:	Jul 11 2009 06:56AM
Credit:	Posted in a Microsoft Security Bulletin MS01-031 on June 7, 2001.
Vulnerable:	Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows 2000 Telnet Privilege Escalation Vulnerability

A vulnerability exists in the way Windows 2000 telnet service handles server-side named pipes and the predictable names used for the pipes.

The predictability of server-side named pipes enables any local user with privileges to execute a program to create a server-side named pipe and assume the security context of the system service. By running the telnet service after arbitrary code has been attached to the appropriate named pipe, the code will be run in the Local System context as part of the initialization process.

Exploit / POC

Microsoft Windows 2000 Telnet Privilege Escalation Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Microsoft Windows 2000 Telnet Privilege Escalation Vulnerability

Solution:
Microsoft has released a patch for Windows 2000 Advanced Server, Professional and Server which rectifies this issue. Microsoft has advised that Windows 2000 Datacenter Server patches are hardware specifice and should be obtained by the original equipment manufacturer.

Microsoft Windows 2000 Professional