Title: Microsoft Windows 2000 Directory Services Restore Mode Blank Password Vulnerability
Severity: MODERATE
Description:
During the boot process, Windows 2000 Server provides a number of operating system modes to assist an Administrator in troubleshooting and restoring a damaged system configuration. In the event that the "Configure your Server" tool was implemented on a system in order to promote it to domain controller status, a blank password will be assigned to the operating system mode 'Directory Service Restore Mode'. This would allow a malicious user who had physical access to the machine to log on in Directory Service Restore Mode with administrative privileges.
The "Configure your Server" tool is used in order to promote a server to become the first domain controller in a forest, which is set of Active Directory domains. The vulnerability lies within the fact that during implementation of the tool, a null password will be assigned to Directory Service Restore Mode. Any user who could physically access the machine would be able to log onto the machine and perform administrative duties that can be exercised in Directory Service Restore Mode. This would also give the user the capability to install a malicious program which would be executed after reboot.
When the password for Directory Service Restore Mode is modified, it is synchronized with the password of the Recovery Console. Therefore, the Recovery Console is also designated a blank password in this situation.
The DCPROMO tool which accomplishes the same task as the "Configure your Server" tool is not affected by this vulnerability.
Successful exploitation of this vulnerability could lead to a full compromise of the system or the domain.
Affected Products:
- Avaya DefinityOne Media Servers
- Avaya IP600 Media Servers
- Avaya S3400 Message Application Server
- Avaya S8100 Media Servers
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Server
References:
- Microsoft: Frequently Asked Questions: Microsoft Security Bulletin (MS00-099)
- Microsoft: Microsoft Security Bulletin (MS00-099)
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
