[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Fw: NT-Servicepack IV: Gemeine Passwort/lücken

----- Original Message -----
From: q/depesche <depesche@quintessenz.at>
To: <quintessenz-list@quintessenz.at>
Sent: Dienstag, 9. Februar 1999 11:34
Subject: NT-Servicepack IV: Gemeine Passwort/lücken

>q/depesche  99.2.9/1
>NT-Servicepack IV: Gemeine Passwort/lücken
>Wer mittels eines LAN-Managers Passwörter auf NT-
>Rechnern vergibt, die Servicepack IV installiert haben & dabei
>Mac, DOS, OS/2 oder auch andere im Netze werken hat,
>sollte wissen, was für ein gemeines Loch dadurch entsteht:
>Das Passwort wird als blankes Nullwertfeld registriert, will
>heissen, das es nicht existiert.
>-.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-
>Russ Cooper
>Microsoft have released a Security Bulletin
>which covers a potentially serious security breach created as
>a result of a LanManager client (DOS, Windows 3.1,
>Windows for Workgroups, OS/2, or Mac) being used to
>change a password on a Windows NT 4.0 system that has
>had SP4 applied.
>Due to the fact that these clients do not use an NT Hash
>during the password change process, the NT Hash is stored
>as a NULL value in the NT SAM. As a result of changes
>introduced with SP4, when an NT system (any version)
>connects using an account whose password was previously
>changed with a LanManager client, that system can provide a
>blank password and be authenticated.
>Therefore the security risk requires three distinct steps in
>order for you to be at risk;
>1. Your NT systems that users are logging into must be
>version 4.0 and have been updated to SP4.
>2. One, or more, of your users must have logged into the NT
>system and changed their password from that client.
>3. Someone must subsequently log into the NT system using
>a valid userID and a blank password.
>Obviously if your users are not logging in from DOS,
>Windows 3.1, Windows for Workgroups, OS/2, or Macs, then
>your NT systems are not compromised by this bug. However,
>the fix should obviously be applied to prevent problems in
>Microsoft have stated, in the bulletin noted above, that it is
>NOT necessary to have users change their passwords after
>applying the fix. The data is being stored correctly in the NT
>SAM, the problem is in the way NT 4.0 SP4 handles null
>password logins from other NT systems only (any version).
>Microsoft have prepared a KB article
>sp> describing the vulnerability.
>relayed by
>Damir Tomicic <tomicic@axis.de>
>-.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-
>q/depesche ist distributed by http://www.netsphere.at
>handicrafters of mailing-lists & more
>-.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-  -.-. --.-
>mailto: erich-moechel@quintessenz.at
>mailto: majordomo@quintessenz.at
>body: unsubscribe quintessenz-list yourmail@ddress.at
>-.-.- --.-  -.-.- --.-  -.-.- --.-