BID:8083

Microsoft Windows 2000 Domain Controller Spoofing Vulnerability

Info

Microsoft Windows 2000 Domain Controller Spoofing Vulnerability

Bugtraq ID:	8083
Class:	Design Error
CVE:
Remote:	Unknown
Local:	Yes
Published:	Jun 26 2003 12:00AM
Updated:	Jun 26 2003 12:00AM
Credit:	This vulnerability was announced by the vendor.
Vulnerable:	Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:	Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4

Discussion

Microsoft Windows 2000 Domain Controller Spoofing Vulnerability

A potential vulnerability has been reported in Windows 2000 that could allow a domain controller to be spoofed. The vulnerability exists because the function MyGetSidFromDomain calls the insecure DsGetDCName API.

Precise details of this vulnerability are not available at this time. This record will be updated when more information becomes available.

This issue was announced with the release of Microsoft Windows 2000 SP4. BID 8045 was sent out to acknowledge the release of this service pack and the announcement of a number of new vulnerabilities. Analysis of these issues is completed and each of the issues is now being assigned its own BID.

Exploit / POC

Microsoft Windows 2000 Domain Controller Spoofing Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Microsoft Windows 2000 Domain Controller Spoofing Vulnerability

Solution:
This issue was fixed in Windows 2000 Service Pack 4:

Microsoft Windows 2000 Professional