MS02-001: Trusted Domain SID Remote Privilege Escalation (311401)

This script is Copyright (C) 2003-2013 Tenable Network Security, Inc.


Synopsis :

The remote host is vulnerable to privilege escalation.

Description :

Trust relationships are created between Windows NT or Windows 2000
domains to allow users in one domain to access resources in other
domains without requiring them to authenticate separately to each
domain. When a user in a trusted domain requests access to a resource
in a trusting domain, the trusted domain supplies authorization data in
the form of a list of Security Identifiers (SIDs) that indicate the
user's identity and group memberships. The trusting domain uses this
data to determine whether to grant the user's request.

A vulnerability exists because the trusting domain does not verify that
the trusted domain is actually authoritative for all the SIDs in the
authorization data. If one of the SIDs in the list identified a user or
security group that is not in the trusted domain, the trusting domain
would accept the information and use it for subsequent access control
decisions. If an attacker inserted chosen SIDs into the
authorization data at the trusted domain, he could elevate his
privileges to those associated with any desired user or group, including
the Domain Administrators group for the trusting domain. This would
enable the attacker to gain full Domain Administrator access on
computers in the trusting domain.

See also :

http://technet.microsoft.com/en-us/security/bulletin/ms02-001

Solution :

Apply the appropriate patches from MS02-001 or apply the latest Windows
service pack.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.4
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Windows : Microsoft Bulletins

Nessus Plugin ID: 11366 ()

Bugtraq ID: 3997

CVE ID: CVE-2002-0018