CVE-2000-0121: Low severity Microsoft Windows NT vulnerability
The Recycle Bin utility in Windows NT and Windows 2000 allows local users to read or modify files by creating a subdirectory with the victim's SID in the recycler directory, aka the "Recycle Bin Creation" vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the ACLs on the system 'recycler' directory so non-privileged/local users cannot create subdirectories or write files there (restrict write/create permissions to Administrators and SYSTEM). This prevents creation of subdirectories using another user's SID.
Windows NT Recycle Bin (recycler directory) directory ACLs / write/create permission = deny write/create for non-administrative users - Compensating control
If ACL changes cannot be applied immediately, restrict which local accounts can log on to affected hosts and run with elevated rights; isolate vulnerable hosts from untrusted user accounts until a permanent fix or ACL hardening is applied.
- Operational
Inspect the recycler directory for any unauthorized subdirectories (for example, folders named with other users' SIDs). Remove unauthorized subdirectories and restore any modified files from known-good backups; audit and monitor the recycler directory for future unauthorized creations.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0121?
CVE-2000-0121 is considered a low severity vulnerability in Windows NT and Windows 2000.
How do I fix CVE-2000-0121?
To fix CVE-2000-0121, apply the recommended security updates provided by Microsoft for the respective versions of Windows NT.
What impact does CVE-2000-0121 have on system security?
CVE-2000-0121 allows local users to read or modify files in a victim's Recycle Bin, compromising data confidentiality.
Which versions of Windows are affected by CVE-2000-0121?
CVE-2000-0121 affects Windows NT 4.0 and its various service packs.
Can CVE-2000-0121 be exploited remotely?
No, CVE-2000-0121 can only be exploited by local users with access to the affected system.