PT-2001-2602 · Microsoft · Runas.Exe+1

Published 2001-12-31 · Updated 2024-08-08 · CVE-2001-1517

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows 2000

Description The issue concerns the storage of cleartext authentication information in memory by RunAs (runas.exe) in Windows 2000. This could potentially allow attackers to obtain usernames and passwords by executing a process allocated the same memory page after a RunAs command terminates. It is noted that the vendor disputes this issue, stating that administrative privileges are already required to exploit it.

Recommendations For Windows 2000, consider restricting access to the runas.exe command to minimize the risk of exploitation, as administrative privileges are required to exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1517

Affected Products

Windows 2000

Runas.Exe

References · 8

• http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0041.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1517 · Security Note
• http://iss.net/security_center/static/7531.php · Patch
• https://t.me/cvenotify/76343 · Telegram Post
• http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00100.html · Note
• https://t.me/cvenotify/89870 · Telegram Post
• http://securityfocus.com/bid/3184 · Note
• https://t.me/cvenotify/80116 · Telegram Post