CVE-2002-0018

In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted…

published June 25, 2002

CVSS
—
EPSS
16%
Percentile
97.0
In the wild
Unconfirmed
What it is

⚠️ A trusting domain lets unauthorized party crash the party! In Windows NT and 2000, a flaw lets attackers inject untrusted SIDs, gaining Domain Admin access like sneaking into an exclusive VIP area. 🔥 Imagine a party where guests are allowed to invite friends. If nobody checks ID, a stranger could stroll in and claim to be the host’s best friend—potential chaos! This vulnerability is like that: it allows unauthorized users to access sensitive areas of the network. If exploited, attackers could elevate their privileges to Domain Administrator within the trusting domain, giving them the power to manipulate settings, access sensitive data, or even bring the whole network down. This could be absolutely devastating for an organization, leading to data breaches and loss of control over critical infrastructure.

Put simply

Imagine a party where guests are allowed to invite friends. If nobody checks ID, a stranger could stroll in and claim to be the host’s best friend—potential chaos! This vulnerability is like that: it allows unauthorized users to access sensitive areas of the network. This vulnerability arises because Windows NT and 2000 fail to verify if the trusted domain is authoritative for all listed Security Identifiers (SIDs). As a result, attackers can inject SIDs from untrusted domains into the authorization data, tricking the system into granting admin privileges.

What to do

If exploited, attackers could elevate their privileges to Domain Administrator within the trusting domain, giving them the power to manipulate settings, access sensitive data, or even bring the whole network down. This could be absolutely devastating for an organization, leading to data breaches and loss of control over critical infrastructure. To mitigate this issue, ensure that domain trusts are properly configured and verify all SIDs received from trusted domains. It's also a good idea to regularly audit domain trusts and keep your systems updated with security patches. 🚀 You've got this! Stay vigilant and take these actions to secure your network! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.16402 · 97.0th percentile
Published
2002-06-25T04:00Z
EPSS history
Timeline
  • 25 JUN 04:00Z
    In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted…
    cvelistv5