PT-2006-1114 · Microsoft · Windows Xp+2

Andres Tarasco · Published 2006-02-07 · Updated 2018-10-19 · CVE-2006-0023

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Windows XP versions SP1 and SP2 through August 2004 Microsoft Windows XP version SP1 Microsoft Windows 2003 (affected versions not specified)

Description: A privilege elevation issue exists due to insecure default ACLs, allowing the Authenticated Users group to modify critical configuration information for various services, including the Simple Service Discovery Protocol (SSDP), Universal Plug and Play Device Host (UPnP), NetBT, SCardSvr, DHCP, and DnsCache services. This could allow a low-privileged user to gain privileges and potentially take complete control of the system. On Windows 2003, only members of the Network Configuration Operators group can remotely exploit this issue, and this group contains no users by default.

Recommendations: For Microsoft Windows XP versions SP1 and SP2 through August 2004, update the operating system to a version released after August 2004 to resolve the issue. For Microsoft Windows XP version SP1, consider restricting access to the identified services, such as SSDP, UPnP, NetBT, SCardSvr, DHCP, and DnsCache, until a patch is available. For Microsoft Windows 2003, restrict access to the Network Configuration Operators group to minimize the risk of exploitation, and consider disabling the vulnerable services until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability on Microsoft Windows 2003.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-0023

Affected Products

Windows 2003

Windows Xp

Windows

References · 24

• http://vupen.com/english/advisories/2006/0417 · Vendor Advisory
• http://microsoft.com/technet/security/advisory/914457.mspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0023 · Security Note
• http://secunia.com/advisories/19313 · Vendor Advisory
• http://secunia.com/advisories/18756 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0023 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-011 · Vendor Advisory
• http://secunia.com/advisories/19238 · Vendor Advisory
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1671 · Note
• http://frsirt.com/english/advisories/2006/0417 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1696 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm · Note
• http://securityfocus.com/archive/1/423587/100/0/threaded · Note
• http://securitytracker.com/id?1015765 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-011 · Note