Microsoft Windows 2000 LDAP over SSL Privilege Escalation Vulnerability (CAN-2001-0502)

Key Information Vulnerability Details Title: Function Exposed via LDAP over SSL Could Enable Passwords to be Changed Identifier: CAN-2001-0502 Affected Software: Microsoft Windows 2000 Risk Level: Critical Vulnerability Description Technical Explanation: This vulnerability involves an LDAP function that is only available when the LDAP server is configured to support LDAP over SSL sessions. The intended purpose of this function is to allow users to modify data attributes of directory objects. However, a flaw exists: when the directory object is a domain user and the data attribute is the domain password, the function does not check the requester’s permissions, potentially allowing a user to change another user’s domain login password. Impact and Recommendations What an Attacker Can Do: Change another user’s domain password, leading to denial of service or unauthorized login to another user’s account, thereby gaining any permissions associated with that user. Recommended Action: Customers currently providing LDAP over SSL sessions should immediately apply the patch. Mitigating Factors LDAP over SSL sessions are not available by default unless an administrator has installed digital certificates. If a firewall is configured to block TCP port 636, the vulnerability cannot be exploited by external users. The vulnerability cannot be used to change local user account passwords on individual computers. Security Update Download Locations: - Windows 2000 Server and Advanced Server: Download Link - Windows 2000 Datacenter Server: Hardware-specific; must be obtained from the original equipment manufacturer. Installation Platforms: Applies to systems running Windows 2000 Service Pack 1 or Service Pack 2. Included in Future Service Pack: Windows 2000 Service Pack 3.

Goal Reached Thanks to every supporter — we hit 100%!

Microsoft Windows 2000 LDAP over SSL Privilege Escalation Vulnerability (CAN-2001-0502)