Detections
Analytics

MS02-001: Trusted Domain SID Remote Privilege Escalation (311401)

critical Nessus Plugin ID 11366

Synopsis

The remote host is vulnerable to privilege escalation.

Description

Trust relationships are created between Windows NT or Windows 2000 domains to allow users in one domain to access resources in other domains without requiring them to authenticate separately to each domain. When a user in a trusted domain requests access to a resource in a trusting domain, the trusted domain supplies authorization data in the form of a list of Security Identifiers (SIDs) that indicate the user's identity and group memberships. The trusting domain uses this data to determine whether to grant the user's request.

A vulnerability exists because the trusting domain does not verify that the trusted domain is actually authoritative for all the SIDs in the authorization data. If one of the SIDs in the list identified a user or security group that is not in the trusted domain, the trusting domain would accept the information and use it for subsequent access control decisions. If an attacker inserted chosen SIDs into the authorization data at the trusted domain, he could elevate his privileges to those associated with any desired user or group, including the Domain Administrators group for the trusting domain. This would enable the attacker to gain full Domain Administrator access on computers in the trusting domain.

Solution

Apply the appropriate patches from MS02-001 or apply the latest Windows service pack.

See Also

https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-001

Plugin Details

Severity: Critical

ID: 11366

File Name: smb_nt_ms02-001.nasl

Version: 1.39

Type: local

Agent: windows

Published: 3/12/2003

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Ease: No known exploits are available

Patch Publication Date: 1/30/2002

Vulnerability Publication Date: 1/30/2002

Reference Information

CVE: CVE-2002-0018

BID: 3997

MSFT: MS02-001

MSKB: 299444