What's the scope of the vulnerability?
This vulnerability could enable an attacker to change the password of a user (including a domain administrator) in a Windows 2000 domain. This could be done for either of two purposes: to prevent the user from logging onto the domain, or to allow the attacker to log into the other user's account.
This vulnerability is subject to several significant constraints:
| • | It could only be exploited via a LDAP over SSL session, but such a session would only be available if the LDAP server had been specifically configured to support LDAP over SSL. A default Windows 2000 LDAP server would not be affected by this vulnerability. |
| • | If normal firewalling practices have been followed, Internet users would not be able to exploit this vulnerability against a corporate network. |
| • | The vulnerability could only be used to change the passwords of domain user accounts. It could not be used to change local user account passwords on individual machines. |
What causes the vulnerability?
The vulnerability results because of a flaw in a function that is exposed via LDAP over SSL in Windows 2000. The flaw could enable an attacker to modify the password attribute of a user object.
What is LDAP?
LDAP (Lightweight Directory Access Protocol) is an industry-standard protocol that enables authorized users to interrogate or modify the data in a metadirectory. For instance, in Windows 2000, LDAP is one protocol used to access data in the Active Directory.
What do you mean by LDAP over SSL?
In Windows 2000, LDAP requests can be levied via either unsecured sessions or secured SSL sessions. Certain functions are only available over secured sessions. The function involved in this vulnerability is such a function; as a result, the vulnerability could only be exploited if LDAP over SSL was available on the domain's LDAP server.
Is LDAP over SSL available by default?
No. Before an LDAP server can participate in an SSL session, the administrator must have obtained a digital certificate and installed it on the server. Unless this has been done, LDAP over SSL is not available, and the vulnerability could not be exploited.
This means that default installations of Windows 2000 are not at risk from this vulnerability. We do, however, recommend that customers who believe that they might choose to make LDAP over SSL services available in the future apply the patch as a safeguard.
What's wrong with the function that contains the vulnerability?
The function is designed to allow data stored in the directory to be modified. However, it should do so subject to the access controls associated with each particular piece of data. The vulnerability results because when modifying one data attribute - the password attribute associated with users - it doesn't correctly check the permissions, and simply processes the request. This could make it possible for an attacker to misuse the function and change another user's domain password.
What would the vulnerability enable an attacker to do?
Gaining the ability to change other users' domain passwords would let an attacker do either of two things. She could change them to some unknown value, simply to prevent the owner of the account from logging into it. On the other hand, she could change the password and then log into the account in order to gain the privileges associated with that account.
Could the attacker change a domain administrator's password?
Yes. Clearly, this is the most serious risk posed by the vulnerability. If the attacker changed a domain administrator's password, she could log into the administrator's account and gain administrative control of the domain.
What permissions would the attacker need in order to exploit the vulnerability?
The function containing the vulnerability can be called by any user, even ones that aren't domain members. As a result, virtually any user who was on the same side of the firewall as an affected server could exploit the vulnerability. However, users outside of the firewall would be unable to exploit the vulnerability, as long as the firewall blocked tcp port 636.
Could the vulnerability be used to change the passwords of local accounts on individual computers?
No. Local user accounts on individual computers are not stored in a directory, and can't be changed via LDAP. Only domain account passwords could be changed via this vulnerability.
I'm running Windows NT 4.0. Am I affected by the vulnerability?
No. Only Windows 2000 systems are affected and even then only if offering LDAP services over SSL.
I'm running Windows 2000. What machines should I apply the patch to?
The patch only needs to be installed Windows 2000 servers, and even then only on servers provide LDAP over SSL.
What does the patch do?
The patch eliminates the vulnerability by ensuring that the affected function only allows users to change data attributes that they are authorized to change.
