CVEvulnerability
CVE-2002-0018
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2002-03-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify that the trusted domain is authoritative for all listed SIDs, which allows remote attackers to gain Domain Administrator privileges on the trusting domain by injecting SIDs from untrusted domains into the authorization data that comes from from the trusted domain.
Affected configurations
• microsoft windows 2000
• microsoft windows nt
Related
Referenced by CWE · observed example (1)
- CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data weakness
References
- http://www.securityfocus.com/bid/3997 www.securityfocus.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-001 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/8023 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A159 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A64 oval.cisecurity.org
- http://www.securityfocus.com/bid/3997 www.securityfocus.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-001 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/8023 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A159 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A64 oval.cisecurity.org