1. CVE-Search
  2. CVE-2002-0018
ID CVE-2002-0018
Summary In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
References
Vulnerable Configurations
  • cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 12-10-2018 - 21:30)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
  • accepted 2016-02-08T10:00:00.000-05:00
    class vulnerability
    contributors
    • name Tiffany Bergeron
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    definition_extensions
    comment Microsoft Windows NT is installed
    oval oval:org.mitre.oval:def:36
    description In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
    family windows
    id oval:org.mitre.oval:def:159
    status accepted
    submitted 2003-05-13T12:00:00.000-04:00
    title Windows NT Trusted Domain Loophole
    version 73
  • accepted 2005-10-19T05:47:00.000-04:00
    class vulnerability
    contributors
    • name Tiffany Bergeron
      organization The MITRE Corporation
    • name Tiffany Bergeron
      organization The MITRE Corporation
    • name Christine Walzer
      organization The MITRE Corporation
    description In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
    family windows
    id oval:org.mitre.oval:def:64
    status accepted
    submitted 2003-05-13T12:00:00.000-04:00
    title Windows 2000 Trusted Domain Loophole
    version 66
refmap via4
bid 3997
xf win-sid-gain-privileges(8023)
Last major update 12-10-2018 - 21:30
Published 08-03-2002 - 05:00
Last modified 12-10-2018 - 21:30
Back to Top