-----BEGIN PGP SIGNED MESSAGE-----

This one is important because the vulnerability could lead to a
compromised Domain Administrator account. Its unlikely, however, that
many of you are actually affected by this now. Only those that are
using LDAP-SSL on their DCs are actually vulnerable. See;

http://support.microsoft.com/support/kb/articles/Q247/0/78.ASP

for the exact steps you must have taken to be considered vulnerable.
Briefly;

1. You're using W2K
2. You've installed an Enterprise Certificate Authority (and a valid
certificate) on a W2K Domain Controller
3. You've modified your domain policy to allow your DCs to use
certificate requests

LDAP-SSL is done over TCP636, so you could also check for traffic on
that port. Typically such traffic would not occur across the
Internet, so its unlikely that you're vulnerable to an outside attack
(but you should check your gateways anyway).

You're not vulnerable by default, as you can see you have to have
taken some pretty significant steps to configure your machine into a
vulnerable situation. Problem is, the actions above are intended to
make your box more secure, so vulnerable systems are sensitive with
critical data on them.

The full bulletin can be found at;

http://www.microsoft.com/technet/security/bulletin/MS01-036.asp

I'm reliably informed that the LDAP service for Exchange Server 5.5
is not affected. NT 4.0 systems are also immune.

The fix will be included in W2K SP3 and does require a reboot (nice
new touch on the MS Security Bulletins).

Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.2

iQCVAwUBOzfLYBBh2Kw/l7p5AQEk7AP+J8ggNhXvMd3N2oy5CKIHBtdqPc4neTX5
YUcGjHdEsjMSDPK8rYeolBQtTfRqoVeT06P+6T4MSDn9ReFPbr7AyD9vldVNRaKp
sObhohdg66GYPspdBNVTdUj29ms/ZmFr2fLZ2Aofuagq9Af3L/CjUBsksXQNZO5p
Jc8ESbCEFps=
=OrrX
-----END PGP SIGNATURE-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]