News

Elevation of Privilege Flaw in Windows 2000

Microsoft warned users of an important new flaw in Windows 2000.

A hacker could use an elaborate process to elevate his or her privileges through a security problem in the Network Connection Manager (NCM) within Windows 2000, Microsoft warned in a bulletin late last week. The flaw rates as a critical vulnerability for client systems and intranet systems, although it is low risk for Internet systems, Microsoft says.

Each time a network connection is established, NCM calls a handler routine that is supposed to run in the security context of the user. The flaw makes it possible for an unprivileged user to cause the handler routine to execute in the security context of LocalSystem.

An attacker who successfully exploits the flaw could supply code to be run as the handler, and establish a network connection to cause NCM to invoke the code, which would run with full system privileges, according to Microsoft's documentation.

To exploit the flaw, an attacker must have credentials to log onto an affected system. As a mitigating factor, Microsoft points out that best practices discourage allowing interactive log on for unprivileged users on business-critical servers, such as domain controllers, ERP servers and database servers. A patch is available to fix the problem.

The security bulletin dealing with the critical flaw, MS02-042, and its associated patch, can be found here:
www.microsoft.com/technet/security/bulletin/MS02-042.asp.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Report: Cost, Sustainability Drive DaaS Adoption Beyond Remote Work

    Gartner's 2025 Magic Quadrant for Desktop as a Service reveals that while secure remote access remains a key driver of DaaS adoption, a growing number of deployments now focus on broader efficiency goals.

  • Windows 365 Reserve, Microsoft's Cloud PC Rental Service, Hits Preview

    Microsoft has launched a limited public preview of its new "Windows 365 Reserve" service, which lets organizations rent cloud PC instances in the event their Windows devices are stolen, lost or damaged.

  • Hands-On AI Skills Now Outshine Certs in Salary Stakes

    For AI-related roles, employers are prioritizing verifiable, hands-on abilities over framed certificates -- and they're paying a premium for it.

  • Roadblocks in Enterprise AI: Data and Skills Shortfalls Could Cost Millions

    Businesses risk losing up to $87 million a year if they fail to catch up with AI innovation, according to the Couchbase FY 2026 CIO AI Survey released this month.