Microsoft Security Bulletin (MS00-096) - Microsoft has released a tool that corrects the permissions on several registry values in Windows 2000. The default permissions allow malicious users to monitor or reconfigure some network devices by displaying the SNMP community name and management station identifiers. Microsoft FAQ on this issue available here
d2e91906cab571f0ef26eb21c3fb73c2fffb4477c47da3c46a5ba001fda6bf67
Microsoft Security Bulletin (MS00-096)
Tool Available for SNMP Parameters Vulnerability
Originally posted: December 06, 2000
Summary
Microsoft has released a tool that corrects the permissions on several registry values in Microsoft® Windows® 2000. The
default permissions could allow a malicious user to monitor or reconfigure certain devices on a network.
Frequently asked questions regarding this vulnerability and the patch can be found at
http://www.microsoft.com/technet/security/bulletin/fq00-096.asp
Issue
This vulnerability is virtually identical to the SNMP Parameters vulnerability affecting Windows NT® 4.0 systems and
discussed in Microsoft Security Bulletin MS00-095. The registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters provides the SNMP community name and SNMP
management station identifiers, if they exist. Reading this information would enable a malicious user to pose as a bona
fide SNMP manager for any community her machine belonged to. Changing this information would enable her to create a
community consisting solely of her local machine, as a way of gaining management privileges on it.
It should be noted that the information revealed by this vulnerability is normally transmitted in plaintext across
SNMP-managed networks. As a result, even in the absence of incorrect registry permissions, a malicious user could carry
out the same attack if she could monitor network communications. SNMP is not installed on Windows 2000 machines by
default.
Affected Software Versions
* Microsoft Windows 2000 Professional
* Microsoft Windows 2000 Server
* Microsoft Windows 2000 Advanced Server
Patch Availability
* http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24500
Note: The Security Configuration and Analysis template provided in the patch can be applied to any Windows 2000 system.
Note Additional security patches are available at the Microsoft Download Center
More Information
Please see the following references for more information related to this issue.
* Frequently Asked Questions: Microsoft Security Bulletin MS00-096,
http://www.microsoft.com/technet/security/bulletin/fq00-096.asp
* Microsoft Security Bulletin MS00-095, Microsoft Security Bulletin
http://www.microsoft.com/technet/security/bulletin/MS00-095.asp.
* Microsoft Knowledge Base article Q266794 discusses this issue and will be available soon.
* Microsoft TechNet Security web site, http://www.microsoft.com/technet/security/default.asp
Obtaining Support on this Issue
This is a fully supported patch. Information on contacting Microsoft Product Support Services is available at
http://support.microsoft.com/support/contact/default.asp.
Acknowledgments
Microsoft thanks Chris Anley of @stake (http://www.atstake.com) for reporting this issue to us and working with us to
protect customers
Revisions
* December 06, 2000: Bulletin Created.
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT
DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER
INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT
CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE
EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
[spacer.gif] Send this document
to a colleague [spacer.gif]
[spacer.gif]
Printer-friendly
version
last updated December 6, 2000
© 2000 Microsoft Corporation. All rights reserved. Terms of use.