Microsoft Windows 2000 Network Connection Manager Privilege Elevation Vulnerability

Bugtraq ID:	5480
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 15 2002 12:00AM
Updated:	Aug 15 2002 12:00AM
Credit:	Announced in Microsoft Security Bulletin MS02-042.
Vulnerable:	Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server
Not Vulnerable:

Microsoft Windows 2000 Network Connection Manager Privilege Elevation Vulnerability

A vulnerability has been discovered in Network Connection Manager (NCM) which may enable users with interactive access to an affected host to gain elevated privileges.

NCM calls a handler routine whenever a network connection is established with the Windows 2000 host system. A flaw exists in NCM which may allow local, unprivileged users to configure the handler routine that is called for new connections.

The affected handler routine is intended to run with the same privileges as the local user, but instead may run in the LocalSystem context, which is the same context that NCM runs in. Local attackers may provide a custom handler routine, which when invoked via the creation of a new connection through NCM will execute with full system privileges.

Microsoft Windows 2000 Network Connection Manager Privilege Elevation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows 2000 Network Connection Manager Privilege Elevation Vulnerability

Solution:
Microsoft has released a fix for Windows 2000 SP2 / SP3 systems:


Microsoft Windows 2000 Server SP2

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Server SP3

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Advanced Server SP3

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Datacenter Server SP2

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Professional SP3

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Advanced Server SP2

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Datacenter Server SP3

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Professional SP2

• Microsoft Q326886
  This patch may be applied to Windows 2000 SP2 or SP3 systems.
  http://www.microsoft.com/Release.asp?ReleaseID=41406

Microsoft Windows 2000 Network Connection Manager Privilege Elevation Vulnerability

References:

• Microsoft Security Bulletin MS02-042 (Microsoft)
  
• Microsoft Technet Security (Microsoft)