Vulnerability Name:

CVE-2000-1200 (CCN-4015)

Assigned:2000-02-01
Published:2000-02-01
Updated:2017-10-10
Summary:Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: CCN
Type: BugTraq Mailing List, Mon Jan 31 2000 - 20:57:24 CST
Windows NT and account list leak ! A new SID usage

Source: CCN
Type: BugTraq Mailing List, Tue Feb 01 2000 - 15:44:10 CST
Re: Windows NT and account list leak ! A new SID usage

Source: MITRE
Type: CNA
CVE-2000-1200

Source: CCN
Type: OSVDB ID: 715
Microsoft Windows NT LsaQueryInformationPolicy Function NULL Session Domain SID Enumeration

Source: BUGTRAQ
Type: Vendor Advisory
20000201 Windows NT and account list leak ! A new SID usage

Source: BID
Type: Exploit, Patch, Vendor Advisory
959

Source: CCN
Type: BID-959
NT LsaQueryInformationPolicy() Domain SID Leak Vulnerability

Source: XF
Type: UNKNOWN
nt-lsa-domain-sid(4015)

Source: XF
Type: UNKNOWN
nt-lsa-domain-sid(4015)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp5:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:microsoft:windows_nt:3.5.1:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:3.5.1:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:3.5.1:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:3.5.1:sp5:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_nt:3.5.1:sp4:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    microsoft windows nt 4.0
    microsoft windows nt 4.0 sp1
    microsoft windows nt 4.0 sp2
    microsoft windows nt 4.0 sp3
    microsoft windows nt 4.0 sp4
    microsoft windows nt 4.0 sp5
    microsoft windows nt 4.0 sp6
    microsoft windows nt 3.5.1 sp2
    microsoft windows nt 3.5.1 sp1
    microsoft windows nt 3.5.1 sp3
    microsoft windows nt 3.5.1 sp5
    microsoft windows nt 4.0 sp6
    microsoft windows nt 3.5.1 sp4