News

Elevation of Privilege Flaw in Windows 2000

• By Scott Bekker
• August 20, 2002

A hacker could use an elaborate process to elevate his or her privileges through a security problem in the Network Connection Manager (NCM) within Windows 2000, Microsoft warned in a bulletin late last week. The flaw rates as a critical vulnerability for client systems and intranet systems, although it is low risk for Internet systems, Microsoft says.

Each time a network connection is established, NCM calls a handler routine that is supposed to run in the security context of the user. The flaw makes it possible for an unprivileged user to cause the handler routine to execute in the security context of LocalSystem.

An attacker who successfully exploits the flaw could supply code to be run as the handler, and establish a network connection to cause NCM to invoke the code, which would run with full system privileges, according to Microsoft's documentation.

To exploit the flaw, an attacker must have credentials to log onto an affected system. As a mitigating factor, Microsoft points out that best practices discourage allowing interactive log on for unprivileged users on business-critical servers, such as domain controllers, ERP servers and database servers. A patch is available to fix the problem.

The security bulletin dealing with the critical flaw, MS02-042, and its associated patch, can be found here:
www.microsoft.com/technet/security/bulletin/MS02-042.asp.