Anfälligkeitssuche        Suche in 187964 CVE Beschreibungen
und 85075 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.0.11366
Kategorie:Windows
Titel:Trusting domains bad verification
Zusammenfassung:NOSUMMARY
Beschreibung:Description:

Trust relationships are created between Windows NT or Windows 2000
domains to allow users in one domain to access resources in other domains
without requiring them to authenticate separately to each domain.
When a user in a trusted domain requests access to a resource in a trusting
domain, the trusted domain supplies authorization data in the form of a list
of Security Identifiers (SIDs) that indicate the user's identity and group
memberships. The trusting domain uses this data to determine whether to
grant the user's request.

A vulnerability exists because the trusting domain does not verify that
the trusted domain is actually authoritative for all the SIDs in the
authorization data. If one of the SIDs in the list identified a user
or security group that is not in the trusted domain, the trusting domain
would accept the information and use it for subsequent access control
decisions. If an attacker inserted SIDs of his choice into the
authorization data at the trusted domain, he could elevate his privileges
to those associated with any desired user or group, including the Domain
Administrators group for the trusting domain. This would enable the attacker
to gain full Domain Administrator access on computers in the trusting domain.

Solution : see http://www.microsoft.com/technet/security/bulletin/ms02-001.mspx
Risk factor : Medium

Querverweis: BugTraq ID: 3997
Common Vulnerability Exposure (CVE) ID: CVE-2002-0018
http://www.securityfocus.com/bid/3997
Microsoft Security Bulletin: MS02-001
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-001
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A159
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A64
XForce ISS Database: win-sid-gain-privileges(8023)
https://exchange.xforce.ibmcloud.com/vulnerabilities/8023
CopyrightThis script is Copyright (C) 2003 Renaud Deraison

Dies ist nur einer von 85075 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2020 E-Soft Inc. Alle Rechte vorbehalten.