CVE-1999-0603: Critical severity Microsoft Windows NT vulnerability
In Windows NT, an inappropriate user is a member of a group, e.g. Administrator, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators, System Operators, etc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the inappropriate user account from any privileged groups listed (Administrator, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators, System Operators) on the Windows NT system. After removal, review and audit group memberships to ensure only authorized accounts remain in these groups.
Windows NT group membership group membership = remove inappropriate user from privileged groups (Administrator, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators, System Operators)
Event History
Frequently Asked Questions
Which accounts are exposed to this issue?
Any inappropriate user account that has been made a member of a privileged Windows NT group is exposed. The affected groups can include Administrator, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators, and System Operators.
What access does an attacker need to exploit this?
The vulnerability is remotely exploitable with low attack complexity and requires no authentication. It can result in complete compromise of confidentiality, integrity, and availability.
How can administrators determine whether they are affected?
Review membership of privileged Windows NT groups and identify users who do not have a legitimate need for the assigned group privileges. Any inappropriate membership in the listed administrative or operator groups indicates exposure.
What can be done if patching is not immediately possible?
Remove inappropriate users from privileged groups and limit membership to authorized accounts only. Prioritize review of Administrator, Domain Admins, Backup Operators, Power Users, and other operator-level groups.