CVE-2002-0421: Medium severity Microsoft Windows NT vulnerability
Published Jun 11, 2002
·Updated
IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.
Affected Software
8 affected components
Microsoft Windows NT=4.0
Microsoft Windows NT=4.0-sp1
Microsoft Windows NT=4.0-sp3
Microsoft Windows NT=4.0-sp6
Microsoft Windows NT=4.0-sp4
Microsoft Windows NT=4.0-sp6a
Microsoft Windows NT=4.0-sp2
Microsoft Windows NT=4.0-sp5
Remediation
Patch Available
Patch Available
Event History
Jun 11, 2002
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-0421?
CVE-2002-0421 has a moderate severity level due to the potential for local users to bypass password policies.
2
How do I fix CVE-2002-0421?
To remediate CVE-2002-0421, restrict access to the /iisadmpwd directory and properly configure user permissions.
3
What versions of Windows NT are affected by CVE-2002-0421?
CVE-2002-0421 affects all versions of Windows NT 4.0, including various service packs.
4
What type of vulnerability is CVE-2002-0421?
CVE-2002-0421 is a local privilege escalation vulnerability.
5
Can remote users exploit CVE-2002-0421?
CVE-2002-0421 cannot be exploited by remote users as it requires local access.