Microsoft Windows NTFS Incorrect Hard Link Auditing Vulnerability
BID:5484
Info
Microsoft Windows NTFS Incorrect Hard Link Auditing Vulnerability
| Bugtraq ID: | 5484 |
| Class: | Design Error |
| CVE: |
CVE-2002-0725 |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 16 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Discovery credited to @stake. |
| Vulnerable: |
Microsoft Windows 2000 Terminal Services SP2 Microsoft Windows 2000 Terminal Services SP1 Microsoft Windows 2000 Terminal Services Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server |
| Not Vulnerable: |
Microsoft Windows XP Professional Microsoft Windows XP Home Microsoft Windows 2000 Terminal Services SP3 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows .NET Web Server Beta 3 Microsoft Windows .NET Standard Server Beta 3 Microsoft Windows .NET Enterprise Server Beta 3 Microsoft Windows .NET Datacenter Server Beta 3 |
Discussion
Microsoft Windows NTFS Incorrect Hard Link Auditing Vulnerability
It has been reported that the Windows 2000 auditing system fails to properly record filesystem events when hard links are involved. Allegedly, the auditing mechanism will log an event when a hard link is created but not specify precisely what occured (only a "ReadAttributes" on the file linked to is logged). There is no record of the link filename in the log. Furthermore, accesses of the file through the hard link will cause events to be logged that are associated with the link filename rather than the file linked to.
It has been reported that the Windows 2000 auditing system fails to properly record filesystem events when hard links are involved. Allegedly, the auditing mechanism will log an event when a hard link is created but not specify precisely what occured (only a "ReadAttributes" on the file linked to is logged). There is no record of the link filename in the log. Furthermore, accesses of the file through the hard link will cause events to be logged that are associated with the link filename rather than the file linked to.
Exploit / POC
Microsoft Windows NTFS Incorrect Hard Link Auditing Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Microsoft Windows NTFS Incorrect Hard Link Auditing Vulnerability
Solution:
The following fixes are available.
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Professional SP2
Solution:
The following fixes are available.
Microsoft Windows 2000 Server SP2
-
Microsoft Windows 2000 SP3
http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/sp3lan g.asp
Microsoft Windows 2000 Datacenter Server SP2
-
Microsoft Windows 2000 SP3
http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/sp3lan g.asp
Microsoft Windows 2000 Advanced Server SP2
-
Microsoft Windows 2000 SP3
http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/sp3lan g.asp
Microsoft Windows 2000 Professional SP2
-
Microsoft Windows 2000 SP3
http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/sp3lan g.asp
References
Microsoft Windows NTFS Incorrect Hard Link Auditing Vulnerability
References:
References: