Page 1 of 1
NT/W2K Security Exploit
Posted: Fri Mar 29, 2002 4:10 pm
by bluewhale
apparently, a new/old security exploit has been circulating in hackers groups for two weeks. The link attached reports on it.
http://www.extremetech.com/article/0,33 ... 754,00.asp
Posted: Fri Mar 29, 2002 6:17 pm
by wvjohn
bump and ouch
Posted: Fri Mar 29, 2002 6:32 pm
by bluewhale
Bump and ouch?
I can picture all KINDS of odd, painful things but.... is that a saying somewhere I haven't been to yet?

.....but wait
Posted: Fri Mar 29, 2002 8:22 pm
by EvilHorace
Do be sure to read the added comments as the "cure" patch now looks questionable.
Can't link the page (oddly) but find the 'Discuss' link at the upper right of the page linked above and read the comments there before doing anything.
Take note of this guys comment there:
"Keep other users off your system until Microsoft comes out with a patch."
Bill Machrone
Editor-in-Chief, ExtremeTech
I DL'd that patch file myself but now after reading the comments, I'm not going to install it yet in my PCs. From what I gather, it's only a LOCAL security issue anyway, right? If so, my ONLY concern then might be if my kid found out about it here and wanted to mess with "my stuff" in my PCs (now all Win2K).
Posted: Fri Mar 29, 2002 8:36 pm
by bluewhale
Agreed big daddy. But... for something like this to be present for soooooo long.
Ahhh Linux, where have you been hiding

Posted: Fri Mar 29, 2002 10:17 pm
by wvjohn
bump to keep the thread up
ouch 'cause with MS it's always one more thing the forgot to check
fortunately my kids don't know 'bout guest privileges, etc.
i didn't read the whole thing, but is this vulnerability usable on an nt 4.0 system which is configured to permit dial in access ? we have tech people on the other end of the state who coordinate a program that is used statewide?
Posted: Sat Mar 30, 2002 1:34 am
by bluewhale
Rasa Frasa. OK. I'll read the article and all the links mannana.
my impression was that you had to have physical access to the unit, but running DEBUG requires only a DOS prompt. I already have it on my list for Sat, but just found out the SoCal 'server' which was supposed to be upgraded to W2K two years ago is on W98.... Have to build a server for them first :chicken
