Authentication Flaw in Windows Debugger

Reported May 22, 2002, byMicrosoft.

VERSIONS AFFECTED

·        Microsoft Windows 2000

·        Microsoft Windows NT 4.0

·        Microsoft Windows NT 4.0 Server, Terminal Server Edition

DESCRIPTION

A vulnerability exists in the authenticationmechanism of the Win2K and NT 4.0 debugging facility that can let anunauthorized program gain access to the debugger. An attacker can use thisvulnerability to cause a running program to execute a program of theattacker’s choice under the system security context.

VENDOR RESPONSE

Thevendor, Microsoft, has released SecurityBulletin MS02-024to address these vulnerabilities and recommends that affected users apply theappropriate patch listed in the bulletin.

CREDIT
Discovered by Microsoft.