CVE-2000-0197: Medium severity Microsoft Windows NT vulnerability
The Windows NT scheduler uses the drive mapping of the interactive user who is currently logged onto the system, which allows the local user to gain privileges by providing a Trojan horse batch file in place of the original batch file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the Windows NT scheduler so it does not use the interactive user's drive mappings when executing scheduled jobs (ensure scheduled tasks do not rely on mapped drives).
Windows NT Scheduler use interactive user's drive mappings = disabled - Compensating control
Restrict write/modify permissions on directories and batch files used by scheduled tasks so local (interactive) users cannot replace or drop Trojan horse batch files in place of the originals.
- Operational
Audit scheduled tasks and their executable/batch files for unauthorized or Trojan replacements; restore any affected files from trusted backups and remove malicious files.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0197?
CVE-2000-0197 is considered a high severity vulnerability due to its ability to allow privilege escalation.
How do I fix CVE-2000-0197?
To mitigate CVE-2000-0197, ensure that users do not have permissions to replace batch files and consider applying any available patches.
Which versions of Windows NT are affected by CVE-2000-0197?
CVE-2000-0197 specifically affects Microsoft Windows NT version 4.0.
What type of attack does CVE-2000-0197 facilitate?
CVE-2000-0197 facilitates local privilege escalation attacks through the execution of a Trojan horse batch file.
Can CVE-2000-0197 be exploited remotely?
CVE-2000-0197 is a local vulnerability and can only be exploited by users with local access to the system.