Trusting Domains Issue

Title: Trusting Domains Do Not Verify Domain Membership of SIDs in Authorization Data

Date: 30 January 2002

Software: Windows NT 4.0, Windows 2000

Impact: Privilege Elevation

Max Risk: Moderate

Bulletin: MS02-001

A vulnerability exists because the trusting domain does not verify that the trusted domain is actually authoritative for all the SIDs in the authorization data. If one of the SIDs in the list identified a user or security group that is not in the trusted domain, the trusting domain would accept the information and use it for subsequent access control decisions. If an attacker inserted SIDs of his choice into the authorization data at the trusted domain, he could elevate his privileges to those associated with any desired user or group, including the Domain Administrators group for the trusting domain. This would enable the attacker to gain full Domain Administrator access on computers in the trusting domain.

View: Microsoft Security Bulletin MS02-001 for more information

Report a problem with article
Previous Story

Serv-U Beta

Next Story

Windows Highlighter 1.0

-1 Comments - Add comment