| VID |
26004 |
| Severity |
30 |
| Port |
139 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The hotfix (Q318593) for the 'Opening Group Policy Files' has not been applied. Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access.
Group Policy in Windows 2000 is implemented by storing data in the Active Directory and the system volume on the domain controller. This storage location is called the Group Policy Object (GPO). When a machine or user logs onto the domain, it reads the GPO and applies the settings it contains. Most of these settings are also refreshed by default every 90 minutes. However, like most operating systems, Windows 2000 provides several types of read access, including exclusive-read, and this could enable an attacker to lock the Group Policy files, thereby allowing a user to prevent Group Policy from being applied for all users affected by the GPO.
* Note: This check requires an account with Guest or upper privileges which can access the registry of the remote host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://www.microsoft.com/technet/security/bulletin/ms02-016.asp
http://www.iss.net/security_center/static/8759.php
* Affected Software
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server |
| Recommendation |
Appy the appropriate patch (Q318593) for your system, as listed in Microsoft Security Bulletin MS02-016, http://www.microsoft.com/technet/security/bulletin/MS02-016.asp |
| Related URL |
CVE-2002-0051 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
