Title: Microsoft Windows NT Dr. Watson 'user.dmp' Permissions Vulnerability
Severity: MODERATE
Description:
Dr. Watson ships with Microsoft Windows NT and is installed by default. Dr. Watson is a system error debugger designed to detect and locate errors in programs. These errors are logged in a text file or saved in a binary crash dump file (user.dmp) everytime a fault occurs. A crash in Outlook Express would result in sensitive information which had resided in memory, such as email passwords or other security-related data, being written to the dump file.
Due to a security flaw in Microsoft Windows NT's implementation of Dr. Watson, the Everyone group has Full Control of the crash dump file (user.dmp). The file contains varied information, including processes running at the time the error occurred, details of the program error itself, information on the system and the user logged in at the time the error took place, etc. If an unauthorized user successfully gained access to this file, they could obtain sensitive information, including (for example) POP3 account passwords, or other private data.
It should be noted that Windows 2000 is subject to the same issue except a user would only gain read access to the 'user.dmp' file.
Successful exploitation of this vulnerability could lead to the disclosure of sensitive information (the POP3 password) and possibly assist in further compromises of the victim's privacy and security.
There have been some reports of PGP passphrase data being included in the user.dmp file when Outlook crashes in the process of encrypting a message.
Affected Products:
- Avaya DefinityOne Media Servers
- Avaya IP600 Media Servers
- Avaya S3400 Message Application Server
- Avaya S8100 Media Servers
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Datacenter Server SP1
- Microsoft Windows 2000 Datacenter Server SP2
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server SP2
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0 SP1
- Microsoft Windows NT Enterprise Server 4.0 SP2
- Microsoft Windows NT Enterprise Server 4.0 SP3
- Microsoft Windows NT Enterprise Server 4.0 SP4
- Microsoft Windows NT Enterprise Server 4.0 SP5
- Microsoft Windows NT Enterprise Server 4.0 SP6
- Microsoft Windows NT Enterprise Server 4.0 SP6a
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0 SP1
- Microsoft Windows NT Server 4.0 SP2
- Microsoft Windows NT Server 4.0 SP3
- Microsoft Windows NT Server 4.0 SP4
- Microsoft Windows NT Server 4.0 SP5
- Microsoft Windows NT Server 4.0 SP6
- Microsoft Windows NT Server 4.0 SP6a
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Terminal Server 4.0 SP1
- Microsoft Windows NT Terminal Server 4.0 SP2
- Microsoft Windows NT Terminal Server 4.0 SP3
- Microsoft Windows NT Terminal Server 4.0 SP4
- Microsoft Windows NT Terminal Server 4.0 SP5
- Microsoft Windows NT Terminal Server 4.0 SP6
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0 SP1
- Microsoft Windows NT Workstation 4.0 SP2
- Microsoft Windows NT Workstation 4.0 SP3
- Microsoft Windows NT Workstation 4.0 SP4
- Microsoft Windows NT Workstation 4.0 SP5
- Microsoft Windows NT Workstation 4.0 SP6
- Microsoft Windows NT Workstation 4.0 SP6a
References:
- Adonis.No.Spam <adonis1@videotron.ca>: PGP 7.x with Outlook will give your passphrase in CLEAR
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
