Remote Registry Access Authentication Vulnerability

A security vulnerability exists in Microsoft® Windows NT 4.0 that under certain conditions could be used to cause a Windows NT 4.0 machine to fail.

Issue

Before a request to access the registry from a remote machine can be processed, it must first be authenticated by the Remote Registry server. If the request is malformed in a specific fashion, it could be misinterpreted by the remote registry server, causing it to fail. Because the Remote Registry server is contained within the winlogon.exe system process on Windows NT 4.0, a failure in that process would cause the entire system to fail.

Only an authenticated user could levy such a request -- an anonymous (or null-session) connection could not cause this failure. An affected machine could be put back into service by rebooting.

Affected Products

• Windows NT Server, Enterprise, Terminal Server and Workstation 4.0

Download

Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=23077

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: June 8, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<