ID de Prueba:	1.3.6.1.4.1.25623.1.0.11366
Categoría:	Windows
Título:	Trusting domains bad verification
Resumen:	NOSUMMARY
Descripción:	Description: Trust relationships are created between Windows NT or Windows 2000 domains to allow users in one domain to access resources in other domains without requiring them to authenticate separately to each domain. When a user in a trusted domain requests access to a resource in a trusting domain, the trusted domain supplies authorization data in the form of a list of Security Identifiers (SIDs) that indicate the user's identity and group memberships. The trusting domain uses this data to determine whether to grant the user's request. A vulnerability exists because the trusting domain does not verify that the trusted domain is actually authoritative for all the SIDs in the authorization data. If one of the SIDs in the list identified a user or security group that is not in the trusted domain, the trusting domain would accept the information and use it for subsequent access control decisions. If an attacker inserted SIDs of his choice into the authorization data at the trusted domain, he could elevate his privileges to those associated with any desired user or group, including the Domain Administrators group for the trusting domain. This would enable the attacker to gain full Domain Administrator access on computers in the trusting domain. Solution : see http://www.microsoft.com/technet/security/bulletin/ms02-001.mspx Risk factor : Medium
Referencia Cruzada:	BugTraq ID: 3997 Common Vulnerability Exposure (CVE) ID: CVE-2002-0018 http://www.securityfocus.com/bid/3997 Microsoft Security Bulletin: MS02-001 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-001 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A159 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A64 XForce ISS Database: win-sid-gain-privileges(8023) https://exchange.xforce.ibmcloud.com/vulnerabilities/8023
Copyright	This script is Copyright (C) 2003 Renaud Deraison

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.