PT-2006-4331 · Microsoft · Windows 2000 Sp4+1

Reed Arvin · Publicado 2006-08-08 · Atualizado 2019-04-30 · CVE-2006-3443

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4

Description The issue is related to an untrusted search path vulnerability in Winlogon, which can be exploited when SafeDllSearchMode is disabled. This allows local users to gain privileges via a malicious DLL in the UserProfile directory. The vulnerability could enable a logged-on user to take complete control of the system.

Recommendations For Microsoft Windows 2000 SP4, enable SafeDllSearchMode to prevent the exploitation of this issue. As a temporary workaround, consider restricting access to the UserProfile directory to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2006-3443

Produtos afetados

Windows 2000 Sp4

Windows

Referências · 12

• http://frsirt.com/english/advisories/2006/3216 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-051 · Aviso do Fabricante
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:155 · Nota
• http://securityfocus.com/bid/19375 · Nota
• http://vupen.com/english/advisories/2006/3216 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-051 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3443 · Nota de Segurança
• http://securitytracker.com/id?1016662 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3443 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A155 · Nota
• http://kb.cert.org/vuls/id/337244 · Nota
• http://secunia.com/advisories/21417 · Aviso do Fabricante