Vulnerability CVE-2002-2132 - CERT Civis.Net

Vulnerability Name:

CVE-2002-2132 (CCN-10957)

Assigned:

2002-12-26

Published:

2002-12-26

Updated:

2017-11-21

Summary:

Windows File Protection (WFP) in Windows 2000 and XP does not remove old security catalog .CAT files, which could allow local users to replace new files with vulnerable old files that have valid hash codes.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Other

References:

Source: BUGTRAQ
Type: Broken Link
20021226 Full Disclosure: Windows File Protection Old Security Catalog Vulnerability

Source: CCN
Type: BugTraq Mailing List, Thu Dec 26 2002 - 04:55:19 CST
Full Disclosure: Windows File Protection Old Security Catalog Vulnerability

Source: MITRE
Type: CNA
CVE-2002-2132

Source: CCN
Type: MSDN Library
MakeCat

Source: XF
Type: Broken Link
wfp-security-catalogs(10957)

Source: CCN
Type: OSVDB ID: 60057
Microsoft Windows File Protection (WFP) Catalog File (.CAT) Modification Hash Code Comparison Bypass

Source: BID
Type: Third Party Advisory, VDB Entry
6483

Source: CCN
Type: BID-6483
Microsoft Windows File Protection Signed File Replacement Vulnerability

Source: XF
Type: UNKNOWN
wfp-security-catalogs(10957)

Source: CCN
Type: Microsoft Knowledge Base Article 222193
Description of the Windows 2000 Windows File Protection Feature

Vulnerable Configuration:

Configuration 1:

cpe:/o:microsoft:windows_2000:*:*:*:*:datacenter_server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:*:*:*:professional:*:*:*

OR cpe:/o:microsoft:windows_2000:*:*:*:*:server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:*:*:ja:server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp1:*:*:advanced_server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp1:*:*:datacenter_server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp1:*:*:professional:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp1:*:*:server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp2:*:*:advanced_server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp2:*:*:datacenter_server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp2:*:*:professional:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp2:*:*:server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp3:*:*:advanced_server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp3:*:*:datacenter_server:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp3:*:*:professional:*:*:*

OR cpe:/o:microsoft:windows_2000:*:sp3:*:*:server:*:*:*

OR cpe:/o:microsoft:windows_xp:*:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_xp:*:*:*:*:home:*:*:*

OR cpe:/o:microsoft:windows_xp:*:gold:*:*:professional:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp1:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_xp:*:sp1:*:*:home:*:*:*

Configuration CCN 1:

cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:xp:*:*:*:*:*:*:*

Denotes that component is vulnerable