| VID |
28034 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The system allows display the last username on the logon screen.
The registry key "DontDisplayLastUserName" is used to determine whether the last username on the logon screen is shown or not. If this registry key is unset, it means that the username is shown by default the next time someone tries to log into the system, when a user successfully logs into an system. Due to this misconfiguration, a attacker can gain the name of a valid user displayed on the logon screen and perform the further attacks against the target system using this information.
For preventing the information disclosure of the system, you should prevent anyone that are logging on from knowing the last user to access the system by setting the system configuration appropriately.
* Registry Settings:
>> System Key: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
>> Value Name: DontDisplayLastUserName
>> Data Type: REG_SZ (String Value)
>> Value Data: (1 = remove username, 0 = display username)
* Note: This check requires an account with Guest or upper privileges which can access the registry of the remote host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://archives.neohapsis.com/archives/sf/ms/2001-q3/0040.html
http://www.cert.org/tech_tips/win_configuration_guidelines.html
* Affected Platforms:
Microsoft Windows 98 or Me any version
Microsoft Windows 2000 or XP any version
Microsoft Windows NT, 2003 any version |
| Recommendation |
Set the value data of the registry key appropriately.
For Windows 98 or Me:
1. Open [HKEY_LOCAL_MACHINE\Network\Logon] using the registry editor(regedit).
2. Create new string value called "DontShowLastUser".
3. Set it to "1" to hide the last user.
4. Restart Windows for the change to take effect.
For Windows 2000 or XP, 2003:
1. Open [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] using the registry editor(regedit).
2. Create a new string value, or Modify the existing value, called "DontDisplayLastUserName".
3. Set it to "1" to enable the restriction.
4. Restart Windows for the change to take effect.
For Windows NT:
1. Open [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] using the registry editor(regedit).
2. Create a new string value, or Modify the existing value, called "DontDisplayLastUserName".
3. Set it to "1" to enable the restriction.
4. Restart Windows for the change to take effect. |
| Related URL |
CVE-1999-0592 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
1353 (ISS) |
|
