🚀 go-pugleaf

�� �� Andrew.bbs@bbs.dlut.edu.cn (����) �Ĵ������ᵽ: ��
:    *Windows
: NT������һ���dz����صİ�ȫ©��������λӡ�ȵĹ���ʦȥ�����
: ����ֻҪ���ܹ����κ���ֵ��뵽NT��������ֻҪ�ܹ������磬
: �㶼���Խ���ijЩ����ֱ��ȡ��NT��������ߵ�Ȩ�ޡ�����λ����
: ʦ�������˵����ν�����Щ����������һ��NT�����򡣶�΢��һ
: ֱ�����ڲŹ����������©����(CNetOnline,Jul.28,1998)
: http://technews.netscape.com/computing/technews/newsitem/0,290,24643,
: 00.html
�����Ǵ�ҳ���ݣ�
   Serious NT bug emerges
By Michael Kanellos[33]
Staff Writer, CNET NEWS.COM
July 27, 1998, 3:20 p.m. PT

update A flaw in Microsoft's[34] Windows NT operating system allows
an ordinary network user, and possibly anyone with Internet access,
to impersonate a system administrator.

Armed with knowledge of how to exploit this flaw, anyone on a Windows
NT client on an NT network can gain the power to switch other users'
passwords, add new addresses, change access rights to confidential
network areas, and generally run the network in the same manner as an
administrator, according to Mark Edwards, a private security
consultant and principal behind the NT Security[35] and NT Shop[36]
Web pages.

"It's a pretty big problem," he said. "Even though it's a local
attack, it's probably one of the top five or six bugs [for Windows
NT]."

Microsoft learned of the bug last week and will issue a patch and
security advisory later this evening on its Security Advisor[37] Web
site, said Karan Khannan, product manager on the NT security team at
Microsoft. The bug does not effect Microsoft's Domain Controller
server, but it can affect other Microsoft servers.

The bug consists of code written by programmers. When executed
through a seat on an NT network, it seeks out the highest
system-level authority for the user that it can find. Inevitably, the
program gets the network to grant the user "debug-level" rights. Once
a user gains these rights, they are only a few steps away from having
the same power as administrator.

The flaw affects both the server and workstation versions of NT 4.0
and 3.51, according to Khannan.

The malevolent user typically has to act from inside the network and
execute the bug program from a computer on the network. Conceivably,
however, an outside actor could exploit the flaw across the Internet
if the network is also using Internet Information server from
Microsoft, said Edwards.

Khannan denied that the bug can work remotely. "Somebody can use this
program if they have physical access local log-on rights," he said.
"Once they have this, they can get elevated privileges."

Prasad Dabak, Sandeep Phadke, and Milind Borate, three programmers
from India, discovered the flaw late last year. Edwards recently
verified the existence of the flaw. The bug is similar to another NT
glitch discovered last year, he added.

The trio are in the midst of publishing a book tentatively titled
"Undocumented Windows NT," a guide to undocumented API (application
program interface) calls.

  

   Latest Headlines
  95 MSN suffers email outage[38]

  95 Agencies crack down on Net scams[39]

  95 Mexican telco eyes U.S. market[40]

  95 Home pages to unite families[41]

  95 Compaq buys AltaVista domain[42]

  95 Big Blue's new big iron[43]

  95 The pharaoh of home networking?[44]

  95 CD-ROMs speed up despite DVD[45]

  95 Priorities straight for Bay[46]

  95 Masterminding the mail[47]

  95 Big names struggle for ISP email[48]

  95 Adobe warns of trouble ahead[49]

  95 Infoseek buys Net directory firm[50]

  95 Apple soars amid market slump[51]

  95 Wireless One in dire straits[52]

  95 Gates depositions open to public[53]

  95 GeoCities doubles on first day[54]

  95 PanAmSat can't explain outage[55]

  95 Wall St. cuts Netscape's gains[56]

  95 Markets fall on Asian fears[57]

   Miss a day?
  95 All the Headlines[58]

<GETWEB FORM A: For help with filling out forms, send a message with the command HELP FORMS>

  Search News.com

[[________________]]
[[ ]] Search: check preceding box, forward entire document to GetWeb

--------------------------------------------------------------------

Help[59]      |      Site Map[60]      |      Company Information[61]      |      
Advertise With Us[62]
Autos[63]      |     Business[64]      |     Computing  &  Internet[65]      |    
Education[66]      |     Entertainment[67]      |     Games[68]      |     Health
[69]      |     Kids & Family[70]      |     Lifestyles[71]      |     Local[72]
      |     Netscape[73]      |     News[74]      |     Personal  Finance[75]      |    
Real Estate[76]      |     Shopping[77]      |     Sports[78]      |     Travel[79]

Copyright co 1998 CNET Inc.[80]


--

     ********************************************************************
     *  ����ˮ����ɫ�԰ף�����ȻЦ�ʵ���������С�񣬿������ǵ�        *
     *  �书���о���                                                *
     ********************************************************************

�� ��Դ:���������� bbs.cst.sh.cn��[FROM: 202.127.16.22]