Microsoft Windows Trusted Domain Privilege Escalation Vulnerability

Bugtraq ID:	3997
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 30 2002 12:00AM
Updated:	Jan 30 2002 12:00AM
Credit:	Reported to Microsoft by Aelita Software (http://www.aelita.com) and Michel Trépanier.
Vulnerable:	Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Terminal Server 4.0 SP5 Microsoft Windows NT Terminal Server 4.0 SP4 Microsoft Windows NT Terminal Server 4.0 SP3 Microsoft Windows NT Terminal Server 4.0 SP2 Microsoft Windows NT Terminal Server 4.0 SP1 Microsoft Windows NT Terminal Server 4.0 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows NT Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP5 Microsoft Windows NT Server 4.0 SP4 Microsoft Windows NT Server 4.0 SP3 Microsoft Windows NT Server 4.0 SP2 Microsoft Windows NT Server 4.0 SP1 Microsoft Windows NT Server 4.0 Microsoft Windows NT Enterprise Server 4.0 SP6a Microsoft Windows NT Enterprise Server 4.0 SP6 Microsoft Windows NT Enterprise Server 4.0 SP5 Microsoft Windows NT Enterprise Server 4.0 SP4 Microsoft Windows NT Enterprise Server 4.0 SP3 Microsoft Windows NT Enterprise Server 4.0 SP2 Microsoft Windows NT Enterprise Server 4.0 SP1 Microsoft Windows NT Enterprise Server 4.0 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server
Not Vulnerable:

Microsoft Windows Trusted Domain Privilege Escalation Vulnerability

Trust relationships can be configured between domains controlled by Microsoft Windows 2000 and NT Server. These trust relationships allow for 'trusted domains' to access resources on 'trusting domains'.

Windows 2000 and NT contain a vulnerability in this feature that may allow for an attacker with administrative privileges on a trusted domain to elevate privileges on any trusting domain.

It is possible for a trusted domain to associate any SID (security identifier) with any security group in the trusting domain. A malicious administrator or an attacker who has obtained administrative privileges on a trusted domain may exploit this vulnerability to obtain control of the trusting domain. For example, a trusted domain may associate a local (within the trusted domain) user SID with the administrative security group on the trusting domain. The SID would then have the privileges of the administrative group within the trusting domain.

It should be noted that it is difficult to exploit this vulnerability.

Microsoft Windows 2000 and NT provide no facility or API allowing for modification of the authorization data required to exploit this vulnerability.

Microsoft Windows Trusted Domain Privilege Escalation Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows Trusted Domain Privilege Escalation Vulnerability

Solution:
Microsoft has released two Security Roll-up Packages to correct this issue.

Windows 2000 Datacenter Server users should obtain the package from the original equipment manufacturer.

A Windows NT Server 4.0, Terminal Server Edition Security Rollup Package is also available.

Fixes listed below:


Microsoft Windows 2000 Server SP2

• Microsoft Q311401
  Microsoft Windows 2000 Security Roll-up Package, January, 2002
  http://www.microsoft.com/windows2000/downloads/critical/q311401/defaul t.asp

Microsoft Windows 2000 Advanced Server SP1

• Microsoft Q311401
  Microsoft Windows 2000 Security Roll-up Package, January, 2002
  http://www.microsoft.com/windows2000/downloads/critical/q311401/defaul t.asp

Microsoft Windows 2000 Advanced Server SP2

• Microsoft Q311401
  Microsoft Windows 2000 Security Roll-up Package, January, 2002
  http://www.microsoft.com/windows2000/downloads/critical/q311401/defaul t.asp

Microsoft Windows NT Enterprise Server 4.0 SP6a

• Microsoft Q299444
  Post-Windows NT 4.0 Service Pack 6a Security Rollup.
  http://support.microsoft.com/default.aspx?scid=kb;en-us;Q299444

Microsoft Windows 2000 Server SP1

• Microsoft Q311401
  Microsoft Windows 2000 Security Roll-up Package, January, 2002
  http://www.microsoft.com/windows2000/downloads/critical/q311401/defaul t.asp

Microsoft Windows NT Server 4.0 SP6a

• Microsoft Q299444
  Post-Windows NT 4.0 Service Pack 6a Security Rollup.
  http://support.microsoft.com/default.aspx?scid=kb;en-us;Q299444

Microsoft Windows 2000 Advanced Server

• Microsoft Q311401
  Microsoft Windows 2000 Security Roll-up Package, January, 2002
  http://www.microsoft.com/windows2000/downloads/critical/q311401/defaul t.asp

Microsoft Windows 2000 Server

• Microsoft Q311401
  Microsoft Windows 2000 Security Roll-up Package, January, 2002
  http://www.microsoft.com/windows2000/downloads/critical/q311401/defaul t.asp

Microsoft Windows Trusted Domain Privilege Escalation Vulnerability

References:

• Microsoft Security Bulletin MS02-001 (Microsoft)
  
• Q317636 Windows NT Server 4.0, Terminal Server Edition, Security Rollup Package (Microsoft)