CVE-2000-0089 in Windows
Summary
by MITRE
The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2025
The CVE-2000-0089 vulnerability represents a critical security flaw in Microsoft Terminal Server Edition and Windows NT 4.0 systems where the rdisk utility creates temporary files containing registry hive information with insufficient access controls. This vulnerability falls under the CWE-276 category of improper file permissions, specifically addressing weak access control mechanisms that allow unauthorized users to access sensitive system information. The vulnerability stems from the rdisk utility's design flaw where it stores registry data in temporary files without proper discretionary access control lists, creating a pathway for local privilege escalation and information disclosure attacks.
The technical implementation of this vulnerability occurs when the rdisk utility executes during system operations, creating temporary files that contain copies of registry hives. These temporary files are typically stored in system directories with default permissions that permit any local user account to read the contents, regardless of their privilege level. The registry hive information stored in these files often contains sensitive configuration data, user credentials, and system settings that could be exploited by malicious actors. The vulnerability is particularly concerning because it operates at the system level, bypassing normal user access controls and providing direct access to registry information that should remain protected.
From an operational perspective, this vulnerability enables local users to enumerate registry information that would otherwise be restricted, potentially exposing system configurations, user accounts, and credential-related data stored in registry keys. Attackers can leverage this information to understand system architecture, identify potential attack vectors, and gather intelligence for more sophisticated attacks. The impact extends beyond simple information disclosure as the registry data may contain references to system services, network configurations, and application settings that could be used to craft targeted attacks or identify system weaknesses. This vulnerability directly maps to the ATT&CK technique T1012 for registry run keys and T1003 for credential dumping, as it provides access to registry-based credential storage mechanisms.
The mitigation strategies for CVE-2000-0089 should focus on implementing proper file access controls and system hardening measures. Organizations should ensure that temporary files created by system utilities are created with restrictive permissions that prevent unauthorized access. The recommended approach includes configuring the rdisk utility to create temporary files with appropriate access control lists that limit access to system administrators only. Additionally, system administrators should implement regular security audits to identify and remove temporary files with weak permissions. Microsoft released patches and updates to address this vulnerability in subsequent service packs for Windows NT 4.0 and Terminal Server Edition, emphasizing the importance of maintaining updated system configurations. The vulnerability also highlights the necessity of following security best practices such as the principle of least privilege and regular security assessments to prevent similar issues in system utilities and temporary file handling mechanisms.