RDISK Registry Enumeration File Vulnerability

The RDISK utility creates a temporary file during execution that can contain security-sensitive information, but does not appropriately restrict access to it. Under certain conditions, it could be possible for a malicious user to read the file as it was being created.

Issue

The RDISK utility is used to create an Emergency Repair Disk (ERD) in order to record machine state information as a contingency against system failure. During execution, RDISK creates a temporary file containing an enumeration of the registry. The ACLs on the file allow global read permission, and as a result, a malicious user who knew that the administrator was running RDISK could open the file and read the registry enumeration information as it was being created. RDISK erases the file upon successful completion, so under normal conditions there would be no lasting vulnerability.

Affected Products

• Windows NT Server, Enterprise, Terminal Server and Workstation 4.0

Solution

Patches are available from the following locations:

• Windows NT 4.0 Workstation; Windows NT 4.0 Server; Windows NT 4.0 Server, Enterprise Edition:
  Intel: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17745
  Alpha: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17747
  
• Windows NT 4.0 Server, Terminal Server Edition:
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17384

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: February 4, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<