BID:8093

Microsoft Windows 2000 Active Directory Forest Origin Validation Vulnerability

Info

Microsoft Windows 2000 Active Directory Forest Origin Validation Vulnerability

Bugtraq ID:	8093
Class:	Origin Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2003 12:00AM
Updated:	Jun 26 2003 12:00AM
Credit:	This issue was reported by Microsoft with the release of Windows 2000 Service Pack 4.
Vulnerable:	Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:	Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4

Discussion

Microsoft Windows 2000 Active Directory Forest Origin Validation Vulnerability

Microsoft Windows 2000 Active Directory Forests have been reported prone to an origin validation vulnerability.

It has been reported that an attacker who is part of a trusted forest, may enroll a certificate in a remote forest which they are not part of.

This vulnerability was originally reported in BID 8045 and is now being assigned a separate individual BID.

Exploit / POC

Microsoft Windows 2000 Active Directory Forest Origin Validation Vulnerability

There is no exploit required.

Solution / Fix

Microsoft Windows 2000 Active Directory Forest Origin Validation Vulnerability

Solution:
The vendor has released a service pack to address this and other issues:

Microsoft Windows 2000 Server SP2