Microsoft Windows SMB Registry : Winlogon Key Permission Weakness

high Nessus Plugin ID 10429

Synopsis

Local users can gain SYSTEM privileges.

Description

The registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon is writeable by users who are not in the admin group.

This key contains a value which defines which program should be run when a user logs on.

As this program runs in the SYSTEM context, the users who have the right to change the value of this key can gain more privileges on this host.

Solution

Use regedt32 and set the permissions of this key to :

- admin group : Full Control
- system : Full Control
- everyone : Read

Plugin Details

Severity: High

ID: 10429

File Name: smb_reg_winlogon_permissions.nasl

Version: 1.33

Type: local

Agent: windows

Family: Windows

Published: 5/29/2000

Updated: 8/3/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Required KB Items: SMB/name, SMB/login, SMB/password, SMB/registry_access, SMB/transport

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-1999-0589

BID: 182

Detections

Analytics