CVE-2000-0089: Low severity Microsoft Windows NT vulnerability

Published Feb 4, 2000

Updated

The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability.

Affected Software

4 affected components

Microsoft Windows NT=4.0

Microsoft Windows NT=4.0-sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Microsoft Windows NT rdisk utility from your environment.
If rdisk is not required, uninstall or remove the rdisk utility to prevent creation of temporary registry-hive files accessible to local users.
Configuration
Ensure the temporary file(s) created by rdisk that contain registry hive information are created or modified to have restrictive ACLs so only SYSTEM and Administrators can read them. Adjust file-creation behavior or apply an ACL immediately after file creation to remove read access from local (non-privileged) users.
rdisk utility (Microsoft Terminal Server Edition and Windows NT 4.0) temporary file permissions = restrict read access to SYSTEM and Administrators only
Compensating control
Restrict access to the directory used for rdisk temporary files (and other temporary directories) via NTFS ACLs or other host-based controls so unprivileged local accounts cannot read files created there.
Operational
Search for and securely delete or securely wipe any existing temporary files created by rdisk that contain registry hive information; verify no sensitive data remains accessible to local users.

Event History

Feb 4, 2000

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Mar 22, 2000

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0089?

CVE-2000-0089 has a medium severity level due to its impact on local user access to sensitive registry information.

How do I fix CVE-2000-0089?

To fix CVE-2000-0089, ensure that the temporary file permissions for the registry hive information are restricted to prevent local user read access.

What systems are affected by CVE-2000-0089?

CVE-2000-0089 affects Microsoft Windows NT 4.0, including its Terminal Server and Enterprise versions.

Can CVE-2000-0089 be exploited remotely?

No, CVE-2000-0089 can only be exploited by local users on the affected system.

What components does CVE-2000-0089 involve?

CVE-2000-0089 involves the rdisk utility and the improper storage of registry hive information.