Microsoft Windows up to XP File Audit Policy privileges management

Summaryinfo

A vulnerability was found in Microsoft Windows up to XP. It has been declared as critical. Affected by this issue is some unknown functionality of the component File Audit Policy. Executing a manipulation can lead to privileges management. This vulnerability is handled as CVE-1999-0577. Additionally, an exploit exists. Configuration settings should be changed.

Detailsinfo

A vulnerability classified as very critical was found in Microsoft Windows up to XP (Operating System). This vulnerability affects some unknown processing of the component File Audit Policy. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A Windows NT system s file audit policy does not log an event success or failure for non-critical files or directories.

The weakness was released 01/01/1999. This vulnerability was named CVE-1999-0577. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/20/2014). The MITRE ATT&CK project declares the attack technique as T1068.

It is declared as highly functional. As 0-day the estimated underground price was around $25k-$100k.

It is possible to mitigate the problem by applying the configuration setting .

The vulnerability is also documented in the databases at X-Force (228) and Vulnerability Center (SBV-11718†). Entries connected to this vulnerability are available at VDB-13833, VDB-14357 and VDB-14358. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7
• 8
• 2000
• NT
• Server 2003
• Vista
• XP

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion