GetAdmin utility present

Risk Level: High risk vulnerability High

Check or Attack Name: Getadmin Present
Platforms: Windows NT
Description:

The getadmin exploit has been run. Problems in Windows NT kernel functions allowed a flag to be set inside the operating system that allows any user to gain administrator privileges. Getadmin leaves a Software\AntiShut key in the registry, and this key has been detected.

An early workaround to getadmin developed by ISS was to create that key and deny non-administrators access. If this key is present but is not writable by non-administrators, it is not considered to be a vulnerability.
Remedy:

Verify whether your system is compromised by checking for users with administration rights. If there are not any users with administrator rights, then fix the kernel by applying the latest Windows NT 4.0 Service Pack or the post-SP3 getadmin-fix. If users are present with administrator rights, reinstall Windows NT and then install the latest service pack or the getadmin-fix.

To verify your system, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
  3. Check if users have administrator privileges on that host.

—AND—

If your system is not compromised, apply the latest Windows NT 4.0 Service Pack or the post-SP3 getadmin-fix patch:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users must apply the post-SP3 lsa2-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/getadmin-fix.
References:

Microsoft Knowledge Base Article Q146965, GetAdmin Utility Grants Users Administrative Rights, http://support.microsoft.com/support/kb/articles/q146/9/65.asp


pcAnywhere detected

Risk Level: Low risk vulnerability Low

Check or Attack Name: PC Anywhere Detect
Platforms: pcAnywhere
Description:

The pcAnywhere program was detected as running. Symantec's pcAnywhere remote access software provides remote connectivity to Windows 95, Windows NT, Windows 3.1, and DOS machines. If improperly configured, it can give people access to your machine.
Remedy:

Review the security settings in your pcAnywhere program. Refer to the pcAnywhere documentation for details.
References:

Symantec pcANYWHERE remote access software, pcANYWHERE information page, http://www.symantec.com/pca/index.html

Symantec pcANYWHERE remote access software, Understanding Security for Telecommuters Using pcANYWHERE, WinFax Pro, and Norton AntiVirus, http://www.symantec.com/telecommute/security.pdf


DCOM can be enabled by non-administrators

Risk Level: Low risk vulnerability Low

Check or Attack Name: DCOM - permissions
Platforms: Windows NT
Description:

Permissions were found improperly set for the DCOM registry key. If enabled, DCOM may be used to remotely execute programs.

Remedy:

Avoid granting non-administrators write access to the Ole key in the Windows NT registry.

To restrict access, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Ole key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Remove write access from all non-Administrators.
References:


NIS server and domain names

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: nisdom
Platforms: Unix
Description:

The password file is obtainable from Network Information Services (NIS). If the domain name can be guessed, then the NIS server can be used to acquire password files.
Remedy:

Choose a hard to guess NIS domain name and use strong password techniques:

  • The NIS domain name should be something hard to guess. If it can be guessed using brute force methods, then change the NIS domain name.
  • In the event that an attacker successfully obtains the password file, the passwords should be hard to guess. The crack utility and password shadowing help correct this weakness, but NIS/YP (Yellow Pages) transfers include encrypted passwords even if they are shadowed and unreadable on the server. The intruder can decode them at leisure using brute force methods.

—AND—

Sun users should obtain Patch ID 100482 "SunOS 4.1.3: ypserv, ypxfrd, & portmap security patch (221709 bytes)." All Sun patches are at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References:

CERT Advisory CA-95.17, rpc.ypupdated Vulnerability, http://www.cert.org/ftp/cert_advisories/CA-95:17.rpc.ypupdated.vul

CERT Advisory CA-95.17, rpc.ypupdated Vulnerability, http://www.cert.org/advisories/CA-95.17.rpc.ypupdated.vul.html


NIS password guessed via TCP

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: nistcp
Platforms: Unix
Description:

NIS passwords can be guessed through TCP by an attacker who possesses the NIS domain name.
Remedy:

For Sun Microsystems computers, apply SunOS Patch ID# 100482-08 available at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References:

FTP directory /pub/patches/ at sunsolve1.sun.com, SunOS 4.1.3: ypserv, ypxfrd & portmap security patch, ftp://sunsolve1.sun.com/pub/patches/100482.readme

CERT Advisory CA-97.22, BIND - the Berkeley Internet Name Daemon, http://www.cert.org/advisories/CA-97.22.bind.html


NIS is running over TCP

Risk Level: | Low risk vulnerability Low | Check or Attack Name: NIS TCP Running
Platforms: | Unix
Description: | Network Information Services (NIS) was found to be running over TCP.
Remedy: | Disable the NIS service if it is not needed.
References: |


NIS password guessed via UDP

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: nisudp
Platforms: | Unix
Description: | NIS passwords can be guessed through UDP by an attacker who possesses the NIS domain name.
Remedy: | Patch NIS. For Sun Microsystems computers, apply SunOS Patch ID# 100482 available at http://sunsolve.sun.com/sunsolve/pubpatches/patches.html.
References: |


NIS is running over UDP

Risk Level: | Low risk vulnerability Low | Check or Attack Name: NIS UDP Running
Platforms: | Unix
Description: | Network Information Services (NIS) has been found running over UDP.
Remedy: | Disable the service if it is not needed.
References: |


Rpc.nisd buffer overflow in Solaris

Risk Level: High risk vulnerability High

Check or Attack Name: NISd Buffer Overflow
Platforms: Solaris: 2.3, Solaris: 2.4, Solaris: 2.5, Solaris: 2.5.1, Solaris: 2.6, Solaris: 2.5 x86, Solaris: 2.5.1 x86, Solaris: 2.6 x86, Solaris: 2.4 x86
Description:

The Solaris rpc.nisd daemon contains a buffer overflow vulnerability that could allow a remote attacker to gain root privileges.
Remedy:

Immediately obtain and install the following patches from Sun:

  • Solaris 2.6: 105401-13
  • Solaris 2.6_x86: 105402-13
  • Solaris 2.5.1: 103612-41
  • Solaris 2.5.1_x86: 103613-41
  • Solaris 2.5: 103187-38
  • Solaris 2.5_x86: 103188-38
  • Solaris 2.4: 101973-35
  • Solaris 2.4_x86: 101974-35
  • Solaris 2.3: 101318-91
References:

Sun Microsystems, Inc. Security Bulletin #00170, rpc.nisd, http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/170&type=0&nav=sec.sba

CERT Advisory CA-98.06, Buffer Overflow in NIS+, http://www.cert.org/advisories/CA-98.06.nisd.html

CIAC Information Bulletin I-058, SunOS rpc.nisd Vulnerability, http://www.ciac.org/ciac/bulletins/i-058.shtml

ISS Security Advisory #3, Remote Buffer Overflow in the rpc.nisd program, http://xforce.iss.net/alerts/advise3.php3


NISd is running over a non-reserved port

Risk Level: | Medium risk vulnerability Medium | Check or Attack Name: NisdReserved
Platforms: | Solaris
Description: | The target has a nisd running over a non-reserved port. This daemon is probably vulnerable to port hijacking and should be moved to a reserved port.
Remedy: | If possible, run the nisd service on a reserved port. Users are recommended to contact their vendors on patch or workaround information.
References: |


LAN Manager security

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: LM security
Platforms: Windows NT, Windows 95
Description:

LAN Manager (LM) challenge/response authentication is enabled for network authentication. This level of authentication is less secure than Windows NT to NT authentication. LAN Manager-style hashes are easily broken by a brute force attack.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Note: This lm-fix patch is not available as of 10 February 99. Microsoft has pulled the patch for compatibility issues. For more information, read the readme file in the following directory.

Windows NT 4.0 SP3 users must apply the lm-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/lm-fix/.

Note: Applying the lm-fix patch will prevent you from accessing a Windows 95 share from this Windows NT machine. You must re-create the LMCompatibilityLevel registry value as described in the following procedure.

—AND—

Using the Registry Editor, set the HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA\LMCompatibilityLevel value to 1 (Send Windows NT authentication and LM authentication only if the server requests it) or 2 (Never send LM authentication). If 2 is selected, the host cannot connect to servers that support only LM authentication, such as Windows 95 and Windows for Workgroups.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.
References:

Microsoft Knowledge Base Article Q147706, How to Disable LM Authentication on Windows NT, http://support.microsoft.com/support/kb/articles/q147/7/06.asp


Passfilt.dll unknown version

Risk Level: Low risk vulnerability Low

Check or Attack Name: Passfilt.dll incorrect
Platforms: Windows NT
Description:

An unknown version of passfilt.dll was detected. Passfilt.dll is distributed by Microsoft as of Windows NT 4.0 Service Pack 2 and rejects weak passwords. The version of Passfilt.dll in %systemroot%\system32 had a size or a checksum that did not match any known passfilt.dll files shipped by Microsoft. A file that is an incorrect size or possesses the wrong checksum can indicate that an attacker is capturing passwords via a Trojan horse program.
Remedy:

Determine if the passfilt.exe file is a Trojan horse or a program placed with malicious intent. If so, consider your system and its security compromised. If not, reinstall passfilt.

To install passfilt, follow these steps:

Passfilt.dll is shipped with Service Pack 2 for Windows NT 4.0 and later. It should be properly installed as per Microsoft Knowledge Base Article Q161990 listed in the References.

If the passfilt.dll installed on this system is a Trojan horse program:

  1. Immediately remove the computer from the network.
  2. Create a backup of the contents of the hard drive, or isolate the data on a non-networked storage device.
  3. Perform a low-level format of all hard drives on the computer.
  4. Reinstall the operating system.
  5. Configure the computer with the original user names, groups, and applications.
  6. Run Internet Scanner or System Scanner to determine vulnerabilities and resolve detected vulnerabilities.
  7. Before using the files on the backup, scan all files using an up-to-date anti-virus program, and copy only the files you know to be authorized on that computer.
  8. Reconnect the computer to the network.
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Passfilt.dll checksum incorrect

Risk Level: High risk vulnerability High

Check or Attack Name: Passfilt.DLL checksum
Platforms: Windows NT
Description:

Passfilt.dll is referenced in the Lsa registry key, but the file found in %systemroot%\system32 had a checksum that did not match any known passfilt.dll files shipped by Microsoft. A file that is the correct size, but possesses the wrong checksum, could indicate an attacker is capturing passwords.
Remedy:

Determine if the passfilt.exe file is a Trojan horse or a program placed with malicious intent. If so, consider your system and its security compromised. If not, reinstall passfilt.

To install passfilt, follow these steps:

Passfilt.dll is shipped with Service Pack 3 for Windows NT 4.0 and later. To install passfilt.dll properly, use the information provided in the Microsoft Knowledge Base Article Q161990 listed below.

—OR—

If the passfilt.dll installed on this system is a Trojan horse program:

  1. Immediately remove the computer from the network.
  2. Create a backup of the contents of the hard drive, or isolate the data on a non-networked storage device.
  3. Perform a low-level format of all hard drives on the computer.
  4. Reinstall the operating system.
  5. Configure the computer with the original user names, groups, and applications.
  6. Run Internet Scanner to determine vulnerabilities, and resolve detected vulnerabilities.
  7. Before using the files on the backup, scan all files using an up-to-date antivirus program, and copy only the files you know to be authorized on that computer.
  8. Reconnect the computer to the network.

Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp or http://support.microsoft.com/support/ntserver/serviceware/10141574.asp.


Passfilt.dll not found

Risk Level: | High risk vulnerability High | Check or Attack Name: Passfilt.DLL Not Found
Platforms: | Windows NT
Description: | The passfilt.dll password filter library is referenced in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry key, but was not found in the %systemroot%\system32 directory. Anyone with permission to add files into the system32 directory could install a Trojan password filter. By default, everyone has permission to add files. Since weak passwords are a common way for attackers to gain access, you should install a strong password filter.
Remedy: | Passfilt.dll is shipped with Service Pack 3 for Windows NT 4.0 and later. To install passfilt.dll properly, use the information provided in Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp .
References: | Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Passfilt.dll not installed

Risk Level: | Low risk vulnerability Low | Check or Attack Name: Passfilt.DLL Not Installed
Platforms: | Windows NT
Description: | Passfilt.dll is not installed. Passfilt.dll ships with Windows NT 4.0 Service Pack 3 (and later), and helps deter users from using trivial passwords. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy: | Passfilt.dll is shipped with Service Pack 3 for Windows NT 4.0 and later. To install passfilt.dll properly, use the information provided in the Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.
References: | Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Winlogon Key has incorrect permissions

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: winlogon permissions
Platforms: Windows NT
Description:

The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key has two values that can be used to run a process during startup, or when a user logs on.

The programs pointed to by the System value run under the system user context after startup, and could be used to change a user's rights or access level.

The UserInit value runs applications when a user logs in.

The default settings for this key allow Server Operators to write these values, either of which could be used to raise a System Operator's access level to Administrator.

Remedy:

Remove Server Operator write access to the winlogon key.

To remove association, follow these steps:

  1. From the Windows NT Start menu, select Run.
  2. Type regedt32 and click OK to open the Registry Editor.
  3. Navigate to KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
  4. From the Security menu, select Permissions.
  5. Remove Server Operator write access.


Account operator includes unallowed user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Account Operator
Platforms: Windows NT
Description:

A user was found in the Account Operators group that is not typically a member of this group. Verify that the user should be a member of this group.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove a user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user in the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups to display the Group Memberships dialog box.
  5. From the Member of list, select Account Operators and click Remove.
  6. Click OK.


Administrators group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Administrator Group
Platforms: Windows NT
Description:

A user was found in the Administrators group that is not typically a member of this group. Verify that the user should be a member of this group.

False Positives: If the user is a legitimate member of this group, then this is not a vulnerability.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove a user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user in the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups to display the Group Memberships dialog box.
  5. From the Member of list, select Administrators and click Remove.
  6. Click OK.


Backup Operator group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Backup Operator
Platforms: Windows NT
Description:

A user was found in the Backup Operators group that is not typically a member of this group. Verify that the user should be a member of this group.

False Positives: If the user is a legitimate member of this group, then this is not a vulnerability.
Remedy:

If the user should not be a member of this group, remove the user from the group. To remove a user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user in the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups to display the Group Memberships dialog box.
  5. From the Member of list, select Backup Operators and click Remove.
  6. Click OK.


Power Users group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Power User
Platforms: Windows NT
Description:

A user was found in the Power Users group that is not typically a member of this group. Verify that the user should be a member of this group.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove a user from a group:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups to display the Group Memberships dialog box.
  5. From the Member of list, select Power Users and click Remove.
  6. Click OK.


Print Operator group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Print Operator
Platforms: Windows NT
Description:

A user was found in the Print Operator group that is not typically a member of this group. Verify that the user should be a member of this group.

False Positives: If the user is a legitimate member of this group, then this is not a vulnerability.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove a user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups to display the Group Memberships dialog box.
  5. From the Member of list, select Print Operator and click Remove.
  6. Click OK.


Replicator group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: Replicator
Platforms: Windows NT
Description:

A user was found in the Replicator group that is not typically a member of this group. Verify that the user should be a member of this group.

False Positives: If the user is a legitimate member of this group, then this is not a vulnerability.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove a user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user in the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Groups to display the Group Memberships dialog box.
  5. From the Member of list, select Replicator and click Remove.
  6. Click OK.


System Operator group includes non-default user

Risk Level: Low risk vulnerability Low

Check or Attack Name: System Operator
Platforms: Windows NT
Description:

A user was found in the System Operator group that is not typically a member of this group. Verify that the user should be a member of this group.

False Positives: If the user is a legitimate member of this group, then this is not a vulnerability.
Remedy:

If the user should not be a member of this group, remove the user from the group.

To remove a user from a group, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Group to display the Group Memberships dialog box.
  5. From the Member of list, select System Operator and click Remove.
  6. Click OK.


IP forwarding enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: IP Forwarding
Platforms: Windows NT
Description:

The machine has IP forwarding enabled. If this machine is outside of the firewall, then it could allow access to internal networks.

Remedy:

If IP forwarding is not allowed by your security policy, then disable IP Forwarding.

WARNING: Installing Windows NT Remote Access Service (RAS) after installing Microsoft Proxy Server will enable IP forwarding. You must disable IP forwarding after installing RAS.

To disable IP forwarding, follow these steps:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Click the Protocols tab.
  3. Select TCP/IP Protocol from the list of network protocols.
  4. Click Properties.
  5. Click the Routing tab.
  6. Clear the Enable IP Forwarding check box.
  7. Click OK twice to apply changes.

—OR—

If you want to disable this function remotely, open the registry on the remote host and locate the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters key. Set the IPEnableRouter value to zero. You will need to reboot the remote host to apply this change.
References:

Microsoft Knowledge Base Article Q164882, Practical Recommendations for Securing Internet-Connections, http://support.microsoft.com/support/kb/articles/q164/8/82.asp


Multihomed host

Risk Level: | Low risk vulnerability Low | Check or Attack Name: multihomed
Platforms: | Windows NT
Description: | The machine has more than one network card installed. Under ordinary circumstances, this is not considered a serious risk. If the machine is placed outside the firewall, it could provide an entry point for an attacker.
Remedy: | If multihomed hosts are outside of your security policy, remove the additional network adapter, modem, or uninstall RAS from the Network Services control panel. Refer to your firewall's documentation for more information.
References: |


Windows NT TCP/IP security not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: TcpIp Security
Platforms: Windows NT
Description:

TCP/IP security is not enabled. Windows NT 4.0 has the ability to restrict the ports that will accept packets, and restrict the protocol types TCP/IP will accept. These settings can be very useful in securing a web server, or other specialized hosts.

WARNING: Disable packet filtering, if you have installed Routing and RAS (RRAS). Filter rules applied in RRAS take precedence.
Remedy:

Enable Windows NT TCP/IP security to permit only the services and ports required.

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. From the Protocols tab, click TCP/IP and select Properties to display the Properties dialog box.
  3. Click the Advanced tab.
  4. Select the Enable Security check box and click Configure.
  5. Set the ports and protocols to permit only the ports you need to run required services. See %SystemRoot%\system32\drivers\etc\SERVICES for a list of services and their associated port.
  6. Click OK four times to save your changes.
  7. Restart the computer for the changes to take effect.


Windows NT trusted domain

Risk Level: Low risk vulnerability Low

Check or Attack Name: Trusted Domain
Platforms: Windows NT
Description:

The host trusts the listed domain(s). If any of the trusted machines are compromised, then the host may also be compromised. Review your trusts regularly and determine if they are required.

There is currently no way to prevent an attacker from acquiring this information if the NetBIOS ports are accessible.
Remedy:

If the domain should not be in the list of trusted domains:

  1. Open User Manager for Domains.
  2. From the Policies menu, select Trust Relationships, and remove the domain.
  3. You may also want to open the User Manager on the trusting domain, and remove your domain.


Trusted host(s) found

Risk Level: | Low risk vulnerability Low | Check or Attack Name: Trusted Host
Platforms: | Unix
Description: | A trusted host relationship between two hosts allows an attacker to use one host to gain access to a second host. All vulnerabilities found on the trusted host can then be applied to the scanned host.
Remedy: | Remove the trusted relationship and use a more secure authentication mechanism. Trusted relationships are often controlled by the contents of the /etc/hosts.equiv file and users' .rhosts files. These files should be sanity checked, and removed as necessary.
References: |


Autologon password readable

Risk Level: High risk vulnerability High

Check or Attack Name: Autologon password
Platforms: Windows NT
Description:

The autologon password is readable by non-Administrators. If the latest Windows NT 4.0 Service Pack has not been applied, attackers can read the autologon password and freely access the system.
Remedy:

Disable autologon, protect the Winlogon registry key, and apply the latest Windows NT 4.0 Service Pack.

If autologon is not being used, disable autologon.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To disable autologon, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run.
  2. Type regedt32 and click OK.
  3. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key.
  4. Select the AutoAdminLogon value.
  5. From the Edit menu, select Delete. Click Yes to confirm the deletion of this value.
  6. Repeat steps 4 and 5 for the DefaultUser and DefaultPassword registry values.

—OR—

If autologon is required, restrict access on the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key to administrators and the system.

To restrict registry access, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run.
  2. Type regedt32 and click OK.
  3. Go to the key that requires permissions.
  4. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  5. Use these guidelines to review the listed permissions:
    • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
    • Review any names with Full Control permissions and determine if the permission is appropriate. Consider using Special Access, Read, or removing permissions if these names do not need to modify items in the key.
    • Review any names with Special Access permissions and determine if the permission is appropriate. Consider using Read or removing permissions if these names do not need to modify items in the key.
    • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

—AND—

To install the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

Windows NT 4.0 SP3 or later service packs create the winreg key.
References:

Microsoft Knowledge Base Article Q114615, Bypassing Automatic Logon in Windows NT, http://support.microsoft.com/support/kb/articles/q114/6/15.asp


Backup Operator account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: Backup Operator Blank Pwd
Platforms: Windows NT
Description:

A Backup Operator account has been detected with a blank password. Blank passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.
  6. From the User menu, select Properties to display the User Properties dialog box.
  7. Type and confirm a non-trivial password.
  8. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


Backup Operator username same as password

Risk Level: High risk vulnerability High

Check or Attack Name: Backup Operator User Pwd
Platforms: Windows NT
Description:

A Backup Operator account was detected using its username as a password. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Disable the user account if it is not needed. To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

—OR—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Disabled account has blank password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Disabled Account Blank Pwd
Platforms: Windows NT
Description:

A disabled user account has been detected with a blank password. Blank passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require that users must use a minimum length for their passwords, or install a password filter to reject weak password choices. Remove the account if it is not needed.

To require users to use a minimum length for their passwords, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Remove the user account if it is not needed. To remove a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. Press Delete and confirm the delete operation.


Disabled account username same as password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Disabled Account User Pwd
Platforms: Windows NT
Description:

A disabled user account is using its username as the password. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Remove the user account if it is not needed.

To remove a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. Press Delete and confirm the delete operation.

—OR—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Domain Administrator account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: Domain Admin Blank Pwd
Platforms: Windows NT
Description:

A Domain Administrator user account has been detected with a blank password. Blank passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed:

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


Domain Administrator has no password

Risk Level: High risk vulnerability High

Check or Attack Name: Domain Admin No Pwd
Platforms: Windows NT
Description:

A Domain Administrator account has been detected with no password required. No password requirement allows attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Make sure all new users are created with an initial, random password:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Assign the user a password that is difficult to guess.

—AND—

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box./LI>
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords.
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Domain Administrator username same as password

Risk Level: High risk vulnerability High

Check or Attack Name: Domain Admin User Pwd
Platforms: Windows NT
Description:

A Domain Administrator user account is using its username as the password. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Domain Guest account has blank password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Domain Guest Blank Pwd
Platforms: Windows NT
Description:

A Domain Guest user account has been detected with a blank password. Blank passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Domain Guest has no password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Domain Guest No Pwd
Platforms: Windows NT
Description:

A Domain Guest account has been detected with no password required. No password requirement allows attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Make sure all new users are created with an initial, random password. Disable the user account if it is not needed.

To change a user's password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user.
  3. From the User menu, select Properties to display the User Properties dialog box.
    4. Assign the user a password that is difficult to guess.

—AND—

Require that users must use a minimum length for their passwords.

To change a password's length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Domain Guest username same as password

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Domain Guest User Pwd
Platforms: Windows NT
Description:

A Domain Guest user account on the host has the same username as the password. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

—OR—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Domain User account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: Domain User Blank Pwd
Platforms: Windows NT
Description:

A Domain User user account has been detected with a blank password. Blank passwords allow attackers unauthorized access to the host, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if it is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


Domain User has no password

Risk Level: High risk vulnerability High

Check or Attack Name: Domain User No Pwd
Platforms: Windows NT
Description:

A Domain User account has been detected with no password required. No password requirement allows attackers unauthorized access to the host, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Make sure all new users are created with an initial, random password:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Assign the user a password that is difficult to guess.

—AND—

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords.

References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Domain User username same as password

Risk Level: High risk vulnerability High

Check or Attack Name: Domain User User Pwd
Platforms: Windows NT
Description:

A Domain Administrator account has the same username as the password. Weak passwords allow attackers unauthorized access to the host, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Disable the account if it is not needed. To disable an account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

—OR—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp .
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Administrator password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: guessedadminpw
Platforms: Windows NT
Description:

The password on the Administrator Account has been guessed. An attacker can gain access to sensitive system files.
Remedy:

Set the Administrator password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager./LI>
  2. Select the Administrator account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Administrator account from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the password.
  6. Click OK.


Guest password guessed

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: guessedguestpw
Platforms: Windows NT
Description:

The password on the Guest Account for this host has been guessed. An attacker can gain access to sensitive system files.
Remedy:

Set the Guest password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Guest account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the Guest account from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the password.
  6. Click OK.


Windows NT account password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: guesseduserpw
Platforms: Windows NT
Description:

The password on a user account has been guessed. An attacker can gain access to sensitive system files.
Remedy:

Set the User password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND&mdash:

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. elect the user account from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the password.
  6. Click OK.


Account Operator password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: Guessed Account Operator Pwd
Platforms: Windows NT
Description:

An Account Operator account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords.

References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Backup Operator password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: Guessed Backup Operator Pwd
Platforms: Windows NT
Description:

A Backup Operator user account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

or maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp .
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Disabled account password guessed

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Guessed Disabled Account Pwd
Platforms: Windows NT
Description:

A disabled account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Remove the account if it is not needed. To remove an account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account to be removed.
  3. Press Delete and confirm the delete action.

—OR—

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp .
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Domain Administrator password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: Guessed Domain Administrator Pwd
Platforms: Windows NT
Description:

A Domain Administrator user account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp .


Domain Guest password guessed

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Guessed Domain Guest Pwd
Platforms: Windows NT
Description:

A Domain Guest user account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Domain User password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: Guessed Domain User Pwd
Platforms: Windows NT
Description:

A Domain User account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Server Operator password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: Guessed Server Operator Pwd
Platforms: Windows NT
Description:

A Server Operator account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp .


Power User password guessed

Risk Level: High risk vulnerability High

Check or Attack Name: Guessed Power User Pwd
Platforms: Windows NT
Description:

A Power User account has a password that has been guessed. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Require users to use a minimum length for their passwords:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Minimum Password Length field, specify a minimum length of at least seven characters.

—AND—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Maximum password age incorrect

Risk Level: Low risk vulnerability Low

Check or Attack Name: Max Pwd Age
Platforms: Windows NT
Description:

The maximum password age is longer than your policy specifies. Passwords should be changed on a regular basis.
Remedy:

Set the maximum password age value so that it equals or is less than the value in the current policy. A value of 30 to 42 days is recommended.

To configure the password age, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. In the Maximum Password Age box, set the Allow Changes In value to at most the value specified by the current policy.
  4. Click OK.
References:

Microsoft Knowledge-Pak Network Suite 10141569, How to: Set maximum password age policy., http://support.microsoft.com/support/ntserver/serviceware/10141569.asp


Minimum password age incorrect

Risk Level: Low risk vulnerability Low

Check or Attack Name: Min Pwd Age
Platforms: Windows NT
Description:

The minimum password age is shorter than your policy specifies. Passwords should not be changed too rapidly, or some users will set a newly changed password to one they have used previously.
Remedy:

Configure the minimum password age to value that your security policy specifies. A value of 1 or 2 days is recommended.

To configure the password age, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. Under Minimum Password Age, set the value determined by your security policy.


Account Operator account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: Account Operator Blank Pwd
Platforms: Windows NT
Description:

An Account Operator user account has been detected with a blank password. Blank passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.
  6. From the User menu, select Properties to display the User Properties dialog box.
  7. Type and confirm a non-trivial password.
  8. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


Account Operator username same as password

Risk Level: High risk vulnerability High

Check or Attack Name: Account Operator User Pwd
Platforms: Windows NT
Description:

An Account Operator user account has the same username as the password. Weak passwords allow attackers unauthorized access to the host, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

—OR—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Power User account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: Power User Blank Pwd
Platforms: Windows NT
Description:

A Power User user account has been detected with a blank password. Blank passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account.
  3. From the Policies menu, select Account.
  4. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


Power User username same as password

Risk Level: High risk vulnerability High

Check or Attack Name: Power User User Pwd
Platforms: Windows NT
Description:

A Power User account has the same username as the password. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy: P>Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

—OR—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Password history length insufficient

Risk Level: Low risk vulnerability Low

Check or Attack Name: Password History
Platforms: Windows NT
Description:

The password history length is less than the specified security policy. Windows NT will prevent a user from reusing the number of passwords specified by the password history length.

Remedy:

Set the password history length value so that it equals or exceeds the value in the current policy.

To change the password history value, follow these steps:

    • Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
    1. From the Policies menu, select Account to display the Account Policy dialog box.
    2. In the Password Uniqueness box, set the value to remember to at least the value specified by the current policy.
    3. Click OK.
            •


Password has expired

Risk Level: Low risk vulnerability Low

Check or Attack Name: Password Expired
Platforms: Windows NT
Description:

The user's password is expired. If the user has not logged on recently, consider deleting or disabling the account. Accounts that are rarely logged on have passwords that are not often changed, and may create unauthorized access opportunities for an attacker.

False Positives: If this account is legitimate, then this condition does not indicate a vulnerability.
Remedy:

If the user account is legitimate, then the user will have to change the password the next time they log in.

—OR—

Remove the account if it is not needed. To remove an account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account to be removed.
  3. Press Delete and confirm the delete action.

—OR—

Disable the user account if it may be needed at a later time. To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


Password never expires

Risk Level: Low risk vulnerability Low

Check or Attack Name: Password Never Expires
Platforms: Windows NT
Description:

The user has a password that will never expire. Unless the user is used for a service account and has a very strong password, this setting will lower your security level, as an attacker has an unlimited amount of time to guess the password, and an unlimited amount of time to use the password once it is guessed.
Remedy:

Remove the Password Never Expires option:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Clear the Password Never Expires check box.
  5. Click OK.


Password cannot change

Risk Level: Low risk vulnerability Low

Check or Attack Name: Password Cannot Change
Platforms: Windows NT
Description:

The user cannot change their password. This setting is not recommended unless this is a service account, as it leads to less frequent password changes.

False Positives: If this is a service account, then this condition does not indicate a vulnerability.
Remedy:

If the user should be able to change their password:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Clear the User Cannot Change Password check box.
  5. Click OK.


Minimum password length insufficient

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: pwlen
Platforms: Windows NT
Description:

The allowable minimum password length is less than the value specified in the current policy. In general, passwords shorter than seven characters are especially susceptible to a brute force attack.
Remedy:

Set the minimum password length so that it equals or exceeds the value in the current policy:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. Set the minimum password length to at least the number of characters specified by the current policy.
  4. Click OK.


Server Operator account has blank password

Risk Level: High risk vulnerability High

Check or Attack Name: Server Operator Blank Pwd
Platforms: Windows NT
Description:

A Server Operator user account has been detected with a blank password. Blank passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password. Require a minimum length for all passwords, or set up a password filter to reject weak password choices. Disable the account if it is not required.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  5. From the User menu, select Properties to display the User Properties dialog box.
  6. Type and confirm a non-trivial password.
  7. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.

—OR—

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.


Server Operator username same as password

Risk Level: High risk vulnerability High

Check or Attack Name: Service Oper Username Same as Password
Platforms: Windows NT
Description:

A Server Operator user account has the same username as the password. Weak passwords allow attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Disable the user account if it is not needed.

To disable a user account, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Select the Account Disabled check box.
  5. Click OK.

—OR—

For maximum password security, apply the passfilt.dll password filter to prevent using a username as a password. See Microsoft Knowledge Base Article Q161990 "How to Enable Strong Password Functionality in Windows NT" at http://support.microsoft.com/support/kb/articles/q161/9/90.asp.


Unknown password filter installed

Risk Level: High risk vulnerability High

Check or Attack Name: Unknown Pwd Filter
Platforms: Windows NT
Description:

An unknown password filter was found registered in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa registry key. If this password filter is not part of your normal security policy, it may represent evidence that the host (and possibly other machines that it trusts) has been compromised.
Remedy:

Verify that the password filter detected is part of your site security, and was not installed by an attacker.

—OR—

If the password filter is unauthorized, consider your system as compromised:

  1. Immediately remove the computer from the network.
  2. Create a backup of the contents of the hard drive, or isolate the data on a non-networked storage device.
  3. Perform a low-level format of all hard drives on the computer.
  4. Reinstall the operating system.
  5. Configure the computer with the original user names, groups, and applications.
  6. Run Internet Scanner to determine vulnerabilities, and resolve detected vulnerabilities.
  7. Before using the files on the backup, scan all files using an up-to-date antivirus program, and copy only the files you know to be authorized on that computer.
  8. Reconnect the computer to the network.


User account has no password

Risk Level: High risk vulnerability High

Check or Attack Name: usernopw
Platforms: Windows NT
Description:

A User account has been detected with no password required. No password requirement allows attackers unauthorized access, including the ability to take over and replace processes, and access other computers on the network.
Remedy:

Set the user password to a minimum length of seven characters and change the password.

To set the minimum password length, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user account from the list.
  3. From the Policies menu, select Account to display the Account Policy dialog box.
  4. For the Minimum Password Length, require a minimum length of at least seven characters.
  5. Click OK.

—AND—

To change the password, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. In the Password field, change the password.
  5. In the Confirm Password field, confirm the new password.
  6. Click OK.

—AND—

For maximum password security, apply the passfilt.dll password filter to reduce guessable passwords.
References:

Microsoft Knowledge Base Article Q161990, How to Enable Strong Password Functionality in Windows NT, http://support.microsoft.com/support/kb/articles/q161/9/90.asp


Samba .. Bug

Risk Level: Low risk vulnerability Low

Check or Attack Name: NT 3.5
Platforms: Windows NT: 3.5
Description:

A version of Windows NT was detected as vulnerable to the Samba .. bug. Windows NT 3.51 prior to Service Pack 3 is vulnerable to the Samba cd.. bug.

If a Samba client attaches to a file system share on a Windows NT 3.5 or 3.51 machine and executes a cd .. command from the root directory of the share, it causes a kernel exception. Depending on the configuration of the machine, it may automatically reboot or require manual intervention. If a Windows 95 share is accessed, this bug allows anyone to gain access to the entire hard drive.
Remedy:

Upgrade to Windows NT 4.0 and apply the latest Windows NT 4.0 Service Pack:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

If it is not possible to upgrade to Windows 4.0, apply the latest Windows NT 3.51 Service Pack available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/ussp5/.
References:

Microsoft Knowledge Base Article Q140818, STOP Message: After "DIR ..\" is Issued from a Samba Client, http://support.microsoft.com/support/kb/articles/q140/8/18.asp


Samba .. Bug

Risk Level: Low risk vulnerability Low

Check or Attack Name: nt3.51Vuln
Platforms: Windows NT: 3.5.1
Description:

Windows NT 3.51 prior to Service Pack 3 is vulnerable to the Samba cd.. bug.

If a Samba client attaches to a file system share on a Windows NT 3.5 or 3.51 machine and executes a cd .. command from the root directory of the share, it causes a kernel exception. Depending on the configuration of the machine, it may automatically reboot or require manual intervention. If a Windows 95 share is accessed, this bug allows anyone to gain access to the entire hard drive.
Remedy:

Upgrade to Windows NT 4.0 and apply the latest Windows NT 4.0 Service Pack. To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

If it is not possible to upgrade to Windows 4.0, apply the latest Windows NT 3.51 Service Pack available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/ussp5/.
References:

Microsoft Knowledge Base Article Q140818, STOP Message: After "DIR ..\" is Issued from a Samba Client, http://support.microsoft.com/support/kb/articles/q140/8/18.asp


Windows NT 4.0 prior to Service Pack 3

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NT 4.0 SP3
Platforms: Windows NT
Description:

Windows NT 4.0 Service Pack 3 (SP3) has not been installed. A number of security patches and enhancements are available in SP3, including:

  • Making the registry unavailable to null sessions (Registry opened through a null session).
  • Allowing user and share enumeration via null sessions to be disabled (Users enumerated through a null session, Shares Enumerated through a null session).
  • Correcting a problem where a machine can be crashed by malformed SMB packets (Windows NT SMB logon DoS).
  • Providing several fixes made available as post-SP2 hotfixes. (IIS ASP dot bug in Microsoft Servers, DNS version vulnerable to denial of service, Windows NT kernel outdated, Out of band crash, and Windows NT SP2 security patches)
  • Including the capability to filter passwords for those found in a dictionary (Windows NT username same as password, Windows NT Administrator username same as password).

Due to the large number of security-related fixes in Service Pack 3, we strongly recommend applying this service pack. Several of these fixes are not available for Windows NT 3.51 and earlier versions, therefore we highly recommend upgrading any machines to SP3, which are running versions of Windows NT prior to 4.0.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.
References:

Microsoft Knowledge Base Article Q147798, Windows NT 4.0 Service Pack 3 Readme.txt File (128-bit), http://support.microsoft.com/support/kb/articles/Q147/7/98.asp

Microsoft Knowledge Base Article Q152841, Windows NT 4.0 Service Pack 3 Readme.txt File (40-bit), http://support.microsoft.com/support/kb/articles/Q152/8/41.asp

Microsoft FTP Server for Windows NT 4.0 SP3, Microsoft Windows NT 4.0 Workstation and Windows NT 4.0 Server Service Pack 3 Readme File, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/ussp3/readme.htm


Windows NT 4.0 beta

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: NT Beta
Platforms: Windows NT: 4.0 beta
Description:

Beta versions of Windows NT 4.0 are known to grant users read and delete access to shares that are set to Everyone - Full Access, regardless of the underlying file permissions.
Remedy:

Upgrade to Windows NT 4.0 release version and apply the latest Windows NT 4.0 Service Pack.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.


Paging file not cleared at shutdown

Risk Level: Low risk vulnerability Low

Check or Attack Name: ClearPageFileAtShutdown
Platforms: Windows NT
Description:

The Windows NT paging file is not cleared at shutdown. This file can contain sensitive information, and should be cleared upon shutdown if required by your security policy. Some versions of the Novell NetWare authentication module will store the username and password in cleartext, and this information can be extracted from the pagefile.
Remedy:

Using Registry Editor, set the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown value to 1.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To clear the Windows NT paging file at shutdow, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run.
  2. Type regedt32 and click OK.
  3. Go to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management key.
  4. Double-click the ClearPageFileAtShutdown value to display the DWORD Editor.
  5. Change the Data value to 1 and click OK.
References:

Microsoft Knowledge Base Article Q182086, How to Clear the Windows NT Paging File at Shutdown, http://support.microsoft.com/support/kb/articles/q182/0/86.asp


Last username appears at logon

Risk Level: Low risk vulnerability Low

Check or Attack Name: Display Last Username
Platforms: Windows NT
Description:

The username of the last user to successfully log in is visible in the Login dialog box. For best security practices, do not display the last username.
Remedy:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

Edit the Winlogon registry key to prevent usernames from appearing in the Login dialog box:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key.
  3. From the Edit menu, select Add Value to display the Add Value dialog box.
  4. Create a value named DontDisplayLastUserName, of Type REG_SZ. Click OK.
  5. Type 1 as the String value and click OK.
  6. Reboot your computer for this change to take effect.

—OR—

If you have access to the System Policy Editor, see Microsoft Knowledge Base Article "How to: Disable displaying the last username to log in" at http://support.microsoft.com/support/ntserver/serviceware/10141614.asp.


Windows NT legal notice not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: Legal Notice
Platforms: Windows NT
Description:

The legal notice is not enabled at logon. Your security policy may require a warning notice that details site security policy.
Remedy:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

Add a legal notice to appear at logon:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Locate the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key.
  3. Add text to both the LegalNoticeCaption and LegalNoticeText values. The LegalNoticeText value is limited to 255 characters. Both values must be set, or the notice will not be displayed.
  4. Reboot the computer for the changes to take effect.

—OR—

If you have access to the System Policy Editor, see Microsoft Knowledge Base Article "How to: Specify logon banner" at http://support.microsoft.com/support/ntserver/serviceware/10141617.asp.

See CERT Advisory CA-92.19 "Keystroke Logging Banner" at http://www.cert.org/advisories/CA-92.19.Keystroke.Logging.Banner.Notice.html for suggestions about notice banners.
References:

CERT Advisory CA-92.19, Keystroke Logging Banner, http://www.cert.org/advisories/CA-92.19.Keystroke.Logging.Banner.Notice.html


Multiple protocols active

Risk Level: Low risk vulnerability Low

Check or Attack Name: multiprotocol
Platforms: Windows NT
Description:

The machine has more than one protocol active. If the machine is outside a firewall, it could provide an entry point for an attacker into the internal network.

Remedy:

If multiple protocols are not allowed by your security policy, remove the protocols not in use.

To remove the unused protocols, follow these steps:

  1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
  2. Double-click the Network icon.
  3. Click the Protocols tab.
  4. Remove unwanted protocols.
  5. Click OK.
  6. Reboot the system for this change to take effect.

For more information, refer to your firewall's documentation.


OS/2 subsystem enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: OS/2 Subsystem Enabled
Platforms: Windows NT
Description:

The OS/2 subsystem is enabled. Enabling the OS/2 subsystem can allow a process to persist across logins.
Remedy:

Change the registry to remove access to the OS/2 subsystem and remove the file that controls the OS/2 subsystem.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To remove the OS/2 subsystem from Windows NT, follow these steps:

  1. Open the Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems key.
  3. Locate the Os2 value.
  4. Write down the file name that is referenced by the value's data.
  5. Delete the registry value.

To remove the files associated with the OS/2 subsystem, follow these steps:

  1. Open Windows NT Explorer or My Computer.
  2. Using the path and file name you noted in step 4 above, delete the file that used to be referenced by the registry.
References:

Microsoft Knowledge Base Article Q105992, Windows NT Subsystems and Associated Files, http://support.microsoft.com/support/kb/articles/q105/9/92.asp


Performance Monitor readable

Risk Level: Low risk vulnerability Low

Check or Attack Name: perfmon
Platforms: Windows NT
Description:

Any member of the Users or Guest group can read the performance counters from the registry. Access to the performance counters is regulated by the permissions on the Software\Microsoft\Windows NT\CurrentVersion\Perflib registry key. Reading the performance counters can give an attacker considerable information regarding which applications a machine is running.
Remedy:

Perform the following procedures:

  • Disable the Guest account:

    1. Open the User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
    2. Select the Guest account from the list.
    3. From the User menu, select Properties to display the User Properties dialog box.
    4. Select the Account Disabled check box.
    5. Click OK.

  • Verify that the appropriate accounts have the Access the computer from the network user right. To prevent remote logon of a Windows NT user account:

    1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
    2. Select the user account from the list.
    3. From the Policies menu, select User Rights to display the User Rights Policy dialog box.
    4. From the Right list, select Access this computer from network.
    5. From the Grant To list, select the user account from the list and click Remove.

  • Restrict registry access to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib key. Under Windows NT 4.0, registry access from the network can be denied completely. To restrict registry access:

    1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
    2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib registry key.
    3. From the Security menu, choose Permissions to display the Registry Key Permissions dialog box.
    4. Use these guidelines to review the listed permissions:
      • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
      • Review any names with Full Control permissions and determine if the permission is appropriate. Consider using Special Access, Read, or removing permissions if these names do not need to modify items in the key.
      • Review any names with Special Access permissions and determine if the permission is appropriate. Consider using Read or removing permissions if these names do not need to modify items in the key.
      • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

References:

Microsoft Knowledge Base Article Q146906, How To Secure Performance Data in Windows NT, http://support.microsoft.com/support/kb/articles/q146/9/06.asp


Windows NT Shutdown without logon enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: ShutdownWithoutLogon
Platforms: Windows NT
Description:

Windows NT Workstation allows a shutdown without the user logging in. This feature should be disabled if a high level of security is desired, and physical access to the power cord and switch has been restricted.
Remedy:

Require users to log in to shut down the system.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To disable shutdowns without login, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key.
  3. Change the value of the ShutdownWithoutLogon value to 0.
  4. Restart your system for this change to take effect.


HKEY_CLASSES_ROOT writable by Everyone

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Writeable HKEY_CLASSES - everyone
Platforms: Windows NT
Description:

HKEY_CLASSES_ROOT is writable by everyone. This setting allows any user to change file associations. If this issue is found under Windows NT 4.0, it may be a sign of tampering.
Remedy:

Restrict registry access or reset permissions (or both).

To restrict registry access, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to the HKEY_CLASSES_ROOT key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Restrict access to all users, or set the permissions to only permit access to approved users.


HKEY_LOCAL_MACHINE writable by non-administrators

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Writable HKEY_LOCAL - non-admin
Platforms: Windows NT
Description:

HKEY_LOCAL_MACHINE was found to be writable by non-administrator users, allowing these users to change file associations. If found under Windows NT 4.0, this issue could be a sign of tampering.
Remedy:

Restrict registry access or reset permissions (or both).

To edit the registry, follow these steps:

  1. Open Registry Editor. From the Windows NT Start Menu, select Run, type regedt32, and click OK.
  2. Go to HKEY_LOCAL_MACHINE.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Restrict access to all or set permissions to allow access to approved Administrators only.


LSA registry key allows full access

Risk Level: High risk vulnerability High

Check or Attack Name: Writable LSA Key - non-admin
Platforms: Windows NT
Description:

The registry key that governs alternate security providers has improper permissions. If a user has the right to change the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key, then a DLL file can be installed that allows all password changes to be written to plaintext, or even transmitted off site. Microsoft shipped Windows NT 4.0 Workstation with the Notification Packages registry key set to FPNWCLNT, which allows any user with write permissions to the %systemroot%\system32 directory to insert a DLL that can process password changes. If the FPNWCLNT.DLL file is detected, then its size is verified as the correct size.
Remedy:

Set permissions for LSA, or if the FPNWCLNT.DLL is not used, remove the FPNWCLNT string from the registry.

Restrict permissions on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key to be written only by the System and Administrators:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

To restrict registry access, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt 32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Use these guidelines to review the listed permissions:
    • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
    • Review any names with Full Control permissions and determine if the permission is appropriate. Consider using Special Access, Read, or removing permissions if these names do not need to modify items in the key.
    • Review any names with Special Access permissions and determine if the permission is appropriate. Consider using Read or removing permissions if these names do not need to modify items in the key.
    • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

—AND—

If the Notification Packages subkey is present, determine if an unauthorized security provider has been installed. If you detect an unauthorized security provider, then this machine should be considered compromised.

What to do if a computer's security is compromised:

  1. Immediately remove the computer from the network.
  2. Create a backup of the contents of the hard drive, or isolate the data on a non-networked storage device.
  3. Perform a low-level format of all hard drives on the computer.
  4. Reinstall the operating system.
  5. Configure the computer with the original user names, groups, and applications.
  6. Run Internet Scanner to determine vulnerabilities, and resolve detected vulnerabilities.
  7. Before using the files on the backup, scan all files using an up-to-date antivirus program, and copy only the files you know to be authorized on that computer.
  8. Reconnect the computer to the network.

—AND—

Choose one of the following options:

  • If the Notification Packages subkey is present and your machine is using FPNW or DSMN, make sure Fpnwclnt.dll in the %SystemRoot%\System32 folder is the version that ships with Windows NT 4.0 Service Pack 3 (05/01/97, 35,088 bytes) and that the NTFS access control list only permits access by administrators and the system.
  • If the Notification Packages subkey is present and FPNWCLNT.DLL is not being used, remove the FPNWCLNT string from this subkey. To disable FPNWCLNT.DLL:
    1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt 32, and click OK..
    2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa key.
    3. Double-click the Notification Packages value.
    4. If the FPNWCLNT string is present, highlight and delete it.
References:

Fyodor's Exploit World, NT LSA secrets, http://www.insecure.org/sploits/NT.LSA.secrets.html


Regedit is associated with .reg files

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: regfile
Platforms: Windows NT
Description:

Regedit.exe was found associated with registry files. An attacker can mail or place a .reg registry file on the system, causing it to modify the registry when the file is run.
Remedy:

Associate the .reg file name extension with a text editor:

Windows NT: Change the association from the File Types dialog box:

  1. Open My Computer.
  2. From the View menu, select Folder Options.
  3. Click the File Types tab.
  4. In the registered file types list, locate and select Registration Entries.
  5. Click Edit.
  6. In the Actions list, click the first action.
  7. Click Edit.
  8. Change all references of regedit.exe to a text editor, such as notepad.exe or wordpad.exe. Click OK.
  9. Repeat steps 6-8 for all actions in the Actions list.
  10. Click OK, then click Close twice to apply the changes.

Windows 95: Because of a problem with existing associations reverting when set from the File Types dialog box, remove and add the association, or change the association from the registry.

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt 32, and click OK.
  2. Go to the HKEY_LOCAL_MACHINE/Software/Classes/regfile/shell/open/command key.
  3. Double-click the value that is similar to <No Name> : REG_SZ : regedit.exe %1 to display the String Editor>
  4. Change the regedit.exe entry to notepad.exe. Do not alter any other portion of the string.
  5. Click OK.

See the references for more information.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

—AND—

Set appropriate registry permissions to prevent non-administrators from changing the HKEY_LOCAL_MACHINE/SOFTWARE/Classes/regfile/shell/open/command key or its values.

After completing the association, if a .reg file appears in your text editor, then an attack may be in progress to compromise your system.
References:

Microsoft Knowledge Base Article Q132664, Changing Association in File Types Dialog Box May Not Work, http://support.microsoft.com/support/kb/articles/q132/6/64.asp


Regfile associations can be changed by non-administrators

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: regfile - permissions
Platforms: Windows NT
Description:

Improper permissions were found on the registry key valuename specifying a command association with registry files.
Remedy:

Restrict non-Administrators write access for the command key in the NT registry.

To restrict write access, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Navigate to HKEY_LOCAL_MACHINE/Software/Classes/regfile/shell/open/command.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Restrict non-Administrators write access.


Registry opened through a null session

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: registry - null session
Platforms: Windows NT
Description:

The registry was accessed through a null session. Information may be obtained that compromises the security of the system.

Remedy:

Apply the latest Windows NT 4.0 Service Pack or the post-SP3 iis-fix patch.

To apply the latest service pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP3 users must install the post-SP3 iis-fix patch, available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/iis-fix/.

—AND—

Restrict anonymous connections by changing the registry. Note: This step must be performed after you apply the post-SP2 sec-fix patch or the latest Windows NT 4.0 Service Pack.

To restrict anonymous connections in Windows NT, follow these steps:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

  1. If you have not already done so, apply Windows NT 4.0 Service Pack 3 or the post-SP2 sec-fix patch available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP2/sec-fix/.
  2. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  3. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA.
  4. From the Edit menu, select Add Value to display the Add Value dialog box.
  5. In the Value Name field, type RestrictAnonymous.
  6. Select REG_DWORD as the Data Type.
  7. Click OK to display the DWORD Editor.
  8. In the Data field, type 1. (Ignore the Radix setting.)
  9. Click OK. Registry Editor adds the key to the registry.
  10. Reboot the system to apply the changes.


Windows NT registry opened remotely

Risk Level: Low risk vulnerability Low

Check or Attack Name: registry
Platforms: Windows NT
Description:

The Windows NT registry may be opened by a remote user. This may indicate that permissions are not set properly, or that possibly the Guest account is enabled with network access rights. An attacker could alter file associations, permitting the introduction of a Trojan horse, or otherwise seriously compromise the machine.

If the host running the scan is a trusted host, this may not indicate a vulnerability. Under Windows NT 4.0, registry access from the network can be denied completely.
Remedy:

Restrict registry access or reset permissions (or both).

To restrict registry access, follow these steps:

  1. Open Registry Editor. From the Windows NT Start Menu, select Run, type regedt32 and click OK.
  2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg key.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Restrict access to all or set permissions to allow access to approved Administrators only.


Scheduler Key has incorrect permissions

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: scheduler permissions
Platforms: Windows NT
Description:

The HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Schedule key controls the Schedule service. Server Operators have permission to write to this registry key that would allow them to manually schedule jobs to be run by the Schedule service. Since the Schedule service normally executes under the system user context, this vulnerability can be used to raise the Server Operator’s access level to Administrator.
Remedy:

Remove Server operator write access to the schedule key in the NT registry.

To remove write access, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Schedule.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Remove Server Operator write access.


Windows NT system key encryption not enabled

Risk Level: Low risk vulnerability Low

Check or Attack Name: SysKey
Platforms: Windows NT
Description:

System key encryption is not enabled. Encrypting the system key with strong encryption protects private account information by encrypting the password data using a 128-bit cryptographically random key, known as a password encryption key.

Strong password encryption may be used on both Windows NT Server and Workstation where account information is stored. Using strong encryption of account passwords adds additional protection for the contents of the Security Accounts Manager (SAM) portion of the registry and subsequent backup copies of the registry information in the %systemroot%\repair directory created using the RDISK command and on system backup tapes.
Remedy:

Apply the latest Windows NT 4.0 Service Pack, or apply the Windows NT 4.0 post-SP3 land-fix and the Winsock 2 update.

To apply the latest Windows NT Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/Where.asp and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—OR—

Windows NT 4.0 SP2 users must apply the post-SP2 sec-fix patch available from ftp://ftp.microsoft.com/bussys/winnt-public/fixes/usa/nt4/hotfixes-postSP2/sec-fix.

—AND—

The System Key is defined using the Syskey.exe command. Only members of the Administrators group can run Syskey.exe. The System Key is the master key used to protect the password encryption key.

To use syskey, log on as an administrator and from a command line, type syskey. Encryption on the system key cannot be reversed once encryption is enabled.
References:

Microsoft Knowledge Base Article Q143475, Windows NT System Key Permits Strong Encryption of the SAM, http://support.microsoft.com/support/kb/articles/q143/4/75.asp

Microsoft Knowledge Base Article Q143475, Windows NT System Key Permits Strong Encryption of the SAM, ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP2/sec-fix/Q143475.txt


Windows NT trojan key permissions

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Trojan Key Permissions
Platforms: Windows NT
Description:

A registry key that may allow a user to trojan other users who log in has been found with improper permissions. The vulnerable keys under HKEY_LOCAL_MACHINE are:

  • Software\Microsoft\Windows\CurrentVersion\App Paths
  • Software\Microsoft\Windows\CurrentVersion\Controls Folder
  • Software\Microsoft\Windows\CurrentVersion\DeleteFiles
  • Software\Microsoft\Windows\CurrentVersion\Explorer
  • Software\Microsoft\Windows\CurrentVersion\Extensions
  • Software\Microsoft\Windows\CurrentVersion\ExtShellViews
  • Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • Software\Microsoft\Windows\CurrentVersion\ModuleUsage
  • Software\Microsoft\Windows\CurrentVersion\RenameFiles
  • Software\Microsoft\Windows\CurrentVersion\Setup
  • Software\Microsoft\Windows\CurrentVersion\SharedDLLs
  • Software\Microsoft\Windows\CurrentVersion\Shell Extensions
  • Software\Microsoft\Windows\CurrentVersion\Uninstall
  • Software\Microsoft\Windows NT\CurrentVersion\Compatibility
  • Software\Microsoft\Windows NT\CurrentVersion\Drivers
  • Software\Microsoft\Windows NT\CurrentVersion\drivers.desc
  • Software\Microsoft\Windows NT\CurrentVersion\Drivers32\0
  • Software\Microsoft\Windows NT\CurrentVersion\Embedding
  • Software\Microsoft\Windows NT\CurrentVersion\MCI
  • Software\Microsoft\Windows NT\CurrentVersion\MCI Extensions
  • Software\Microsoft\Windows NT\CurrentVersion\Ports
  • Software\Microsoft\Windows NT\CurrentVersion\ProfileList
  • Software\Microsoft\Windows NT\CurrentVersion\WOW
Remedy:

Use Registry Editor to set permissions on each of these keys to Administrators: Full Access, System: Full Access, and Everyone: Read Access.

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

Note: Restricting security on these keys may impair a user's ability to install software.


Registry access allowed for all users

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: winreg - everyone
Platforms: Windows NT
Description:

Unrestricted remote access for all users to the registry has been successful. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg key permissions are set to allow access to all users via a null session. If this key is not present, remote access to the registry is not controlled. If this key is detected and Windows NT 4.0 Service Pack 3 or later has not been applied, then non-authenticated users can write registry keys.

If the Everyone group is denied access, null session access to the registry can be prevented.
Remedy:

Apply the latest Windows NT 4.0 Service Pack and modify the registry for RestrictAnonymous.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—AND—

To restrict registry access, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\SecurePipeServers\Winreg.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Use these guidelines to review the listed permissions:
    • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
    • Review any names with Full Control permissions and determine if the permission is appropriate. Consider using Special Access, Read, or removing permissions if these names do not need to modify items in the key.
    • Review any names with Special Access permissions and determine if the permission is appropriate. Consider using Read or removing permissions if these names do not need to modify items in the key.
    • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

If an Allowed Paths subkey is present under the winreg key, inspect permissions on these paths closely. This optional subkey defines specific paths into the registry that are allowed access, regardless of the security on the winreg registry key. It contains multiple strings representing registry entries that can be read by Everyone. This subkey allows specific system functions, such as checking printer status, to work correctly regardless of how access is restricted via the winreg registry key. The default security on the AllowedPaths registry key only grants Administrators the ability to manage these paths.
References:

Microsoft Knowledge Base Article Q155363, HOWTO: Regulate Network Access to the Windows NT Registry, http://support.microsoft.com/support/kb/articles/q155/3/63.asp


Registry access unrestricted from network

Risk Level: High risk vulnerability High

Check or Attack Name: winreg
Platforms: Windows NT
Description:

The SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg key is not present. This key controls remote access to the registry. If the 'everyone' group is not allowed access, null session access to the registry can be prevented. This vulnerability can allow non-authenticated users to write registry keys, if this key is not present, remote access to the registry is not controlled, and Service Pack 3 is not applied.
Remedy:

Apply the latest Windows NT 4.0 Service Pack and modify the registry for RestrictAnonymous.

To apply the latest Windows NT 4.0 Service Pack, follow these steps:

  1. Open a web browser.
  2. Go to http://support.microsoft.com/support/ntserver/Content/ServicePacks/ and follow the directions to download the appropriate service pack for your computer.
  3. Find the installation program you downloaded to your computer.
  4. Double-click the program icon to start the installation.
  5. Follow the installation directions.

—AND—

To set permission to the winreg key in the NT registry, follow these steps:

  1. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA.
  3. From the Security menu, select Permissions to display the Registry Key Permissions dialog box.
  4. Restrict access from Everyone.


Messenger service running

Risk Level: Low risk vulnerability Low

Check or Attack Name: messenger
Platforms: Windows NT
Description:

The messenger service was detected as running. The Windows NT messenger service lets a user send pop-up messages to other users.

A network administrator may consider this ability as an unnecessary risk because these types of services have been used in social engineering attacks. Some users may respond to a request to change their password, create a share, or otherwise open holes in the network. A side effect of running this service is that it causes the current user name to be broadcasted in the NetBIOS name table, giving an attacker a valid user name to use in brute force attempts.
Remedy:

Disable the Messenger service.

To stop or disable a service in Windows NT, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Service.
  2. Select the service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.


Windows NT remote access service

Risk Level: Low risk vulnerability Low

Check or Attack Name: RAS
Platforms: Windows NT
Description:

Remote Access services were discovered. These services provide users dial-in/out capabilities. These services may bypass required security mechanisms and provide network access to attackers.

Remedy:

Remove RAS if it is not needed, or configure RAS to disallow incoming calls.

  • Stop or disable each of the Remote Access services. To stop or disable a service in Windows NT, follow these steps:
    1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
    2. Select the service from the list.
    3. Click Stop.
    4. When the service has stopped, click Startup.
    5. Choose one of these options:
      • To permanently disable the service, click Disabled.
      • To turn the service off unless manually activated by the user or a program, click Manual.
    6. Click OK, then click Close.

      7. —AND—

    7. From the Network control panel, remove Remote Access Services from the computer. To remove a network service from Windows NT, follow these steps:
      1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
      2. Click the Services tab.
      3. Highlight the service you want to remove.
      4. Click Remove and confirm the removal.
      5. Click OK to close the Network control panel.

      —OR—

    8. If RAS is required, disallow the dial-in option. This action does not remove the vulnerability, but it does make RAS somewhat safer from incoming connections. To disable dial-in for Remote Access Services (RAS), follow these steps:
      1. Open the Network control panel. From the Windows NT Start menu, select Settings, Control Panel, Network.
      2. From the Services tab, select Remote Access Services.
      3. Click Properties.
      4. Select the communication device you want to configure.
      5. Click Configure.
      6. Set the Port Usage to Dial Out Only and click OK.
      7. Repeat steps 4 to 6 for other communication devices.


Windows NT rcmd service running

Risk Level: Low risk vulnerability Low

Check or Attack Name: rcmd
Platforms: Windows NT
Description:

The Rcmd service was detected as running. This service allows users to execute command-line programs from remote hosts and is distributed in the Windows NT Resource Kit. Rcmd is known to be vulnerable to spoofing because it uses native Windows NT challenge-response authentication, instead of host-level authentication.
Remedy:

Remove the rcmd service.

To remove the rcmd services, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Under Services, select rcmd.
  3. Click Stop.


Windows NT rlogin service installed

Risk Level: Low risk vulnerability Low

Check or Attack Name: ntrlogin
Platforms: Windows NT
Description:

The Windows NT host is running the Ataman rlogin service. A user with a rlogin client could potentially compromise the machine's security with a brute force password attack. Also, this service could write sensitive information to the Windows NT Application Log.

Typically, the application log does not contain information an attacker would find useful. However, some applications, such as the Ataman Telnet, Rlogin, and Rexec services, may write sensitive information to the application log.
Remedy:

Disable rlogin if it is not needed or strengthen user name security by implementing strong password security and setting password restrictions in accordance with your security policy.

To check and set the password policy, follow these steps:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. From the Policies menu, select Account to display the Account Policy dialog box.
  3. For the Minimum Password Length, require a minimum length of at least seven characters. Click OK.
  4. Set other password values in accordance with your security policy.

—OR—

To stop or disable the rlogin service in Windows NT, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the FTP service.
  3. Click Stop.
  4. When the service has stopped, click Startup.
  5. Choose one of these options:
    • To permanently disable the service, click Disabled.
    • To turn the service off unless manually activated by the user or a program, click Manual.
  6. Click OK, then click Close.


Windows NT schedule service running

Risk Level: Low risk vulnerability Low

Check or Attack Name: schedule
Platforms: Windows NT
Description:

The Windows NT schedule service was detected as running. This service allows administrators to schedule batch jobs to occur at specified times. Since the schedule service normally executes jobs as the system account, it can be used to modify account privileges. It is also disabled as part of the configuration needed to make a Windows NT machine C2 secure. Due to the fact that the schedule service requires administrator-level access to cause jobs to run, it is considered a low risk.

The Windows NT schedule service has been detected running. This service allows administrators to schedule batch jobs to occur at specified times. Since the schedule service normally executes jobs as the system account, it can be used to modify account privileges. Because the schedule service requires administrator-level access to run jobs, it is considered a low risk vulnerability.
Remedy:

Remove the schedule service.

To disable the service, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Under Services, select Task Scheduler.
  3. Click Stop.


Windows NT service user

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Service User
Platforms: Windows NT
Description:

A Windows NT service was detected running under an account other than LocalSystem. If services are installed under a domain-level account, any compromised workstation using the service will also compromise the domain at the level of that user.
Remedy:

Set the service to run in the local user context, or as LocalSystem.

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Startup.
  4. Set the service to either run under a local user context, or as LocalSystem. Some services will not function properly if this setting is changed, so carefully test your configuration and contact the vendor for additional support.

—AND—

Windows NT 4.0 SP3 users can install the post-SP3 lsa2-fix to keep remote users from obtaining the password. However, some security researchers have demonstrated acquiring these passwords even with the fix installed, thus the fix does not completely solve the problem. This capability is not widespread (as of September 1998), but may become common knowledge.


Windows NT service user password found

Risk Level: High risk vulnerability High

Check or Attack Name: Service User Pwd
Platforms: Windows NT
Description:

A Windows NT service was detected running under an account other than LocalSystem, and has revealed its password. If services are installed under a domain-level account, any compromised workstation using the service will also compromise the domain at the level of that user.

To detect this vulnerability, the machine must be assessed at the administrator level. This vulnerability may be an indication that the machine has other severe vulnerabilities.
Remedy:

Set the service to run in the local user context, or as LocalSystem.

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the service.
  3. Click Startup.
  4. Set the service to either run under a local user context, or as LocalSystem.

Some services will not function properly if this setting is changed, so test your configuration carefully and contact the vendor for additional support.

—AND—

Windows NT 4.0 SP3 users can install the post-SP3 lsa2-fix to keep remote users from obtaining the password. However, some security researchers have demonstrated acquiring these passwords even with the fix installed, thus the fix does not completely solve the problem. This capability is not widespread (as of September 1998), but may become common knowledge.


SQL server running

Risk Level: Low risk vulnerability Low

Check or Attack Name: SQL Server
Platforms: Windows NT
Description:

An SQL server has been detected running. This information is gathered from querying the server information, and can be restricted to authenticated users by setting the RestrictAnonymous registry key.
Remedy:

To restrict anonymous connections in Windows NT, follow these steps:

WARNING: Incorrectly using Registry Editor may cause severe and irreparable damage and may require you to reinstall your operating system. Internet Security Systems cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

  1. If you have not already done so, apply the latest Windows NT 4.0 Service Pack available at http://support.microsoft.com/support/ntserver/Content/ServicePacks/.
  2. Open Registry Editor. From the Windows NT Start menu, select Run, type regedt32, and click OK.
  3. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA key.
  4. From the Edit menu, select Add Value to display the Add Value dialog box.
  5. In the Value Name field, type RestrictAnonymous.
  6. Select REG_DWORD as the Data Type.
  7. Click OK to display the DWORD Editor.
  8. In the Data field, type 1. (Ignore the Radix setting.)
  9. Click OK. Registry Editor adds the key to the registry.
  10. Reboot the system to apply the changes.

Note: Changing the Registry entries is only effective after Windows NT 4.0 Service Pack 3 or later has been applied.


Unknown Windows NT service

Risk Level: Low risk vulnerability Low

Check or Attack Name: Unknown NT Service
Platforms: Windows NT
Description:

A service was found, which was not known to ship as a default service with Windows NT. Services can be used to install back doors, or provide unauthorized network access. Any service that is not approved by your security policy should be removed.

False Positives: If this service is authorized under your security policy, then this issue is not a vulnerability.
Remedy:

Use instsrv from the Windows NT Resource Kit to remove the unwanted service.

To remove a service, follow these steps:

  1. From the Windows NT Start menu, select Run.
  2. Type cmd and click OK to open the command line.
  3. At a command prompt, type instsrv [service name] remove and press Enter.
  4. Type exit and press Enter to return to Windows NT.


Windows NT rexec service running

Risk Level: Low risk vulnerability Low

Check or Attack Name: rexec
Platforms: Any, Windows NT
Description:

The rexec service has been detected as running. This service allows a user to execute commands remotely, and typically requires that usernames and passwords be passed in clear text across the network. Under Windows NT, the Ataman version of this service writes errors to the application log. The application log is readable by any user with permission to access the computer from the network, which could potentially report details about why a given user was unable to log in.

Remedy:

Remove the exec service.

To disable the rexec service, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. From the Services list, select rexec.
  3. Click Stop.

Remove the rexec from inetd.conf.

Unix: To remove rexec, follow these steps:

  1. Comment out rexec from inetd.conf.
  2. Restart the inetd process.


Windows NT rsh service Running

Risk Level: | High risk vulnerability High | Check or Attack Name: rshsvc
Platforms: | Windows NT
Description: | The Rsh service was detected as running. A version of rsh ships with the Windows NT Resource Kit, which executes all commands, regardless of user, under the system account. The system account is the most powerful account on a Windows NT computer, and we recommend not running this service under any circumstances. If this service is detected, use the instsrv tool, which also ships with the Windows NT Resource Kit, to remove the rsh service.
Remedy: | Remove the rshsvc service. To remove the service, follow these steps: OL> From the Windows NT Start menu, select Settings, Control Panel, Services. Under Services, select shsvc. Click Stop.
References: |


Windows NT Network Monitor

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: Network Monitor
Platforms: Windows NT
Description:

The Microsoft Network Monitor (NetMon) program has a weakly decrypted password in a DLL file. Access to this file would allow an attacker to gain access to the network monitor.
Remedy:

Disable the Network Monitor Agent and remove the BHSUPP.DLL file from %systemroot%\system32. If the Network Monitor is required, use a hard to guess password.

To disable the Network Monitor agent, follow these steps:

  1. Open the Services control panel. From the Windows NT Start menu, select Settings, Control Panel, Services.
  2. Select the Network Monitor service and click Stop.
  3. Click Startup.
  4. Select the Disabled startup type.
  5. Click OK.

—AND—

Remove BHSUPP.DLL from %systemroot%\system32.


SMB share full access

Risk Level: High risk vulnerability High

Check or Attack Name: All Access NetBIOS share found
Platforms: Windows, Windows for Workgroups: 3.11, OS/2
Description:

An SMB share was detected with no password required for full access. In some cases, an attacker can use these shares to gain access to the entire hard drive. It is common to find shares with all access enabled, since this is the default when the share is created. It is best to explicitly set the access control list on all shares.

False Positives: In some cases, machines running Samba will show false positives.

False Negatives: Applying the lm-fix patch will prevent you from accessing a Windows 95 share from a Windows NT machine.
Remedy:

Remove the share.

Windows: To remove a share, choose one of these options:

  • Remove the share from a local computer:

    1. From the local computer, open Windows NT Explorer.
    2. Navigate to the shared folder.
    3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
    4. To disallow access to all users, select the Not Shared check box.

  • Remove the share from a remote computer:

    1. From a remote computer, open the Server Manager.
    2. Select the host name.
    3. From the Computer menu, select Shared Directories to display the Shared Directories dialog box.
    4. Select the NetBIOS share.
    5. Choose Stop Sharing.

  • Remove the share from the command line:

    From a command prompt, type: net share sharename /delete

Other Operating Systems: Enable some form of access control as described in your OS documentation.


NetBIOS share full access by Everyone group

Risk Level: Medium risk vulnerability Medium

Check or Attack Name: All Access NetBIOS share - Everyone
Platforms: Windows NT, Samba, Windows 95
Description:

A NetBIOS share has been detected with no access control. This misconfiguration can allow access to the entire hard drive on unpatched versions of Windows NT.

In Windows NT, it is common to find shares with all access enabled, since this is the default when the share is created. It is best to explicitly set the access control list on shares. If this vulnerability was detected on a version of Windows NT prior to Service Pack 3 (SP3), an attacker can use shares to cause the machine to crash.
Remedy:

Set the permissions explicitly or remove the share.

  • Grant share access only to approved users.
    1. From the local computer, open Windows NT Explorer.
    2. Navigate to the shared folder.
    3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
    4. Click Permissions.
    5. Use these guidelines to review the listed permissions:
      • Remove or change any permissions such as Everyone - Full Control. This default permission allows all users to read, modify, and even change ownership and permissions on the items in the share.
      • Review any names with Change or Full Control permissions and determine if the permission is appropriate. Consider using Read Only or No Access if these names do not need to modify items in the share.
      • Review any names that should not be in the list, and remove the name or change their permission as appropriate.

—OR—

Windows: To remove a share, choose one of these options:

  • Remove the share from a local computer:

    1. From the local computer, open Windows NT Explorer.
    2. Navigate to the shared folder.
    3. Right-click the shared folder name and select Sharing to display the Properties dialog box.
    4. To disallow access to all users, select the Not Shared check box.

  • Remove the share from a remote computer:

    1. From a remote computer, open the Server Manager.
    2. Select the host name.
    3. From the Computer menu, select Shared Directories to display the Shared Directories dialog box.
    4. Select the NetBIOS share.
    5. Choose Stop Sharing.

  • Remove the share from the command line:

    From a command prompt, type: net share sharename /delete

Other Operating Systems: Enable some form of access control as described in your OS documentation.
References:

Microsoft Knowledge Base Article Q128079, Updated Drivers for File and Printer Sharing Security, http://support.microsoft.com/support/kb/articles/q128/0/79.asp


Internet Scanner Vulnerabilities by Category

Overview

This help file contains descriptions of 105 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Category
Category: Vulnerabilities:
Backdoors
Getadmin Present | GetAdmin utility present
PC Anywhere Detect | pcAnywhere detected
DCOM
DCOM - permissions DCOM can be enabled by non-administrators
NIS
NIS TCP Running | NIS is running over TCP
NIS UDP Running | NIS is running over UDP
NISd Buffer Overflow | Rpc.nisd buffer overflow in Solaris
NisdReserved | NISd is running over a non-reserved port
nisdom | NIS server and domain names
nistcp | NIS password guessed via TCP
nisudp | NIS password guessed via UDP
NT Critical Issues
LM security | LAN Manager security
Passfilt.DLL Not Found | Passfilt.dll not found
Passfilt.DLL Not Installed | Passfilt.dll not installed
Passfilt.DLL checksum | Passfilt.dll checksum incorrect
Passfilt.dll incorrect | Passfilt.dll unknown version
winlogon permissions | Winlogon Key has incorrect permissions
NT Groups
Account Operator | Account operator includes unallowed user
Administrator Group | Administrators group includes non-default user
Backup Operator | Backup Operator group includes non-default user
Power User | Power Users group includes non-default user
Print Operator | Print Operator group includes non-default user
Replicator | Replicator group includes non-default user
System Operator | System Operator group includes non-default user
NT Networking
IP Forwarding | IP forwarding enabled
TcpIp Security | Windows NT TCP/IP security not enabled
Trusted Domain | Windows NT trusted domain
Trusted Host | Trusted host(s) found
multihomed | Multihomed host
NT Password
Account Operator Blank Pwd | Account Operator account has blank password
Account Operator User Pwd | Account Operator username same as password
Autologon password | Autologon password readable
Backup Operator Blank Pwd | Backup Operator account has blank password
Backup Operator User Pwd | Backup Operator username same as password
Disabled Account Blank Pwd | Disabled account has blank password
Disabled Account User Pwd | Disabled account username same as password
Domain Admin Blank Pwd | Domain Administrator account has blank password
Domain Admin No Pwd | Domain Administrator has no password
Domain Admin User Pwd | Domain Administrator username same as password
Domain Guest Blank Pwd | Domain Guest account has blank password
Domain Guest No Pwd | Domain Guest has no password
Domain Guest User Pwd | Domain Guest username same as password
Domain User Blank Pwd | Domain User account has blank password
Domain User No Pwd | Domain User has no password
Domain User User Pwd | Domain User username same as password
Guessed Account Operator Pwd | Account Operator password guessed
Guessed Backup Operator Pwd | Backup Operator password guessed
Guessed Disabled Account Pwd | Disabled account password guessed
Guessed Domain Administrator Pwd | Domain Administrator password guessed
Guessed Domain Guest Pwd | Domain Guest password guessed
Guessed Domain User Pwd | Domain User password guessed
Guessed Power User Pwd | Power User password guessed
Guessed Server Operator Pwd | Server Operator password guessed
Max Pwd Age | Maximum password age incorrect
Min Pwd Age | Minimum password age incorrect
Password Cannot Change | Password cannot change
Password Expired | Password has expired
Password History | Password history length insufficient
Password Never Expires | Password never expires
Power User Blank Pwd | Power User account has blank password
Power User User Pwd | Power User username same as password
Server Operator Blank Pwd | Server Operator account has blank password
Service Oper Username Same as Password | Server Operator username same as password
Unknown Pwd Filter | Unknown password filter installed
guessedadminpw | Administrator password guessed
guessedguestpw | Guest password guessed
guesseduserpw | Windows NT account password guessed
pwlen | Minimum password length insufficient
usernopw | User account has no password
NT Patches
NT 3.5 | Samba .. Bug
NT 4.0 SP3 | Windows NT 4.0 prior to Service Pack 3
NT Beta | Windows NT 4.0 beta
nt3.51Vuln | Samba .. Bug
NT Policy Issues
ClearPageFileAtShutdown | Paging file not cleared at shutdown
Display Last Username | Last username appears at logon
Legal Notice | Windows NT legal notice not enabled
OS/2 Subsystem Enabled | OS/2 subsystem enabled
ShutdownWithoutLogon | Windows NT Shutdown without logon enabled
multiprotocol | Multiple protocols active
perfmon | Performance Monitor readable
NT Registry
SysKey | Windows NT system key encryption not enabled
Trojan Key Permissions | Windows NT trojan key permissions
Writable HKEY_LOCAL - non-admin | HKEY_LOCAL_MACHINE writable by non-administrators
Writable LSA Key - non-admin | LSA registry key allows full access
Writeable HKEY_CLASSES - everyone | HKEY_CLASSES_ROOT writable by Everyone
regfile | Regedit is associated with .reg files
regfile - permissions | Regfile associations can be changed by non-administrators
registry | Windows NT registry opened remotely
registry - null session | Registry opened through a null session
scheduler permissions | Scheduler Key has incorrect permissions
winreg | Registry access unrestricted from network
winreg - everyone | Registry access allowed for all users
NT Services
RAS | Windows NT remote access service
SQL Server | SQL server running
Service User | Windows NT service user
Service User Pwd | Windows NT service user password found
Unknown NT Service | Unknown Windows NT service
messenger | Messenger service running
ntrlogin | Windows NT rlogin service installed
rcmd | Windows NT rcmd service running
rexec | Windows NT rexec service running
rshsvc | Windows NT rsh service Running
schedule | Windows NT schedule service running
Network Sniffers
Network Monitor Windows NT Network Monitor
NT Password
All Access NetBIOS share - Everyone | NetBIOS share full access by Everyone group
All Access NetBIOS share found | SMB share full access


Internet Scanner Vulnerabilities by Risk Level

Overview

This help file contains descriptions of 105 vulnerabilities. These vulnerabilities are listed by category in the following table. You can also view this list of vulnerabilities by risk level or search for a particular vulnerability in the index.

Internet Scanner Vulnerabilities by Risk Level
Category: Vulnerabilities:
High
Account Operator Blank Pwd | Account Operator account has blank password
Account Operator User Pwd | Account Operator username same as password
All Access NetBIOS share found | SMB share full access
Autologon password | Autologon password readable
Backup Operator Blank Pwd | Backup Operator account has blank password
Backup Operator User Pwd | Backup Operator username same as password
Domain Admin Blank Pwd | Domain Administrator account has blank password
Domain Admin No Pwd | Domain Administrator has no password
Domain Admin User Pwd | Domain Administrator username same as password
Domain User Blank Pwd | Domain User account has blank password
Domain User No Pwd | Domain User has no password
Domain User User Pwd | Domain User username same as password
Getadmin Present | GetAdmin utility present
Guessed Account Operator Pwd | Account Operator password guessed
Guessed Backup Operator Pwd | Backup Operator password guessed
Guessed Domain Administrator Pwd | Domain Administrator password guessed
Guessed Domain User Pwd | Domain User password guessed
Guessed Power User Pwd | Power User password guessed
Guessed Server Operator Pwd | Server Operator password guessed
NISd Buffer Overflow | Rpc.nisd buffer overflow in Solaris
Passfilt.DLL Not Found | Passfilt.dll not found
Passfilt.DLL checksum | Passfilt.dll checksum incorrect
Power User Blank Pwd | Power User account has blank password
Power User User Pwd | Power User username same as password
Server Operator Blank Pwd | Server Operator account has blank password
Service Oper Username Same as Password | Server Operator username same as password
Service User Pwd | Windows NT service user password found
Unknown Pwd Filter | Unknown password filter installed
Writable LSA Key - non-admin | LSA registry key allows full access
guessedadminpw | Administrator password guessed
guesseduserpw | Windows NT account password guessed
rshsvc | Windows NT rsh service Running
usernopw | User account has no password
winreg | Registry access unrestricted from network
Low
Account Operator | Account operator includes unallowed user
Administrator Group | Administrators group includes non-default user
Backup Operator | Backup Operator group includes non-default user
ClearPageFileAtShutdown | Paging file not cleared at shutdown
DCOM - permissions | DCOM can be enabled by non-administrators
Display Last Username | Last username appears at logon
IP Forwarding | IP forwarding enabled
Legal Notice | Windows NT legal notice not enabled
Max Pwd Age | Maximum password age incorrect
Min Pwd Age | Minimum password age incorrect
NIS TCP Running | NIS is running over TCP
NIS UDP Running | NIS is running over UDP
NT 3.5 | Samba .. Bug
OS/2 Subsystem Enabled | OS/2 subsystem enabled
PC Anywhere Detect | pcAnywhere detected
Passfilt.DLL Not Installed | Passfilt.dll not installed
Passfilt.dll incorrect | Passfilt.dll unknown version
Password Cannot Change | Password cannot change
Password Expired | Password has expired
Password History | Password history length insufficient
Password Never Expires | Password never expires
Power User | Power Users group includes non-default user
Print Operator | Print Operator group includes non-default user
RAS | Windows NT remote access service
Replicator | Replicator group includes non-default user
SQL Server | SQL server running
ShutdownWithoutLogon | Windows NT Shutdown without logon enabled
SysKey | Windows NT system key encryption not enabled
System Operator | System Operator group includes non-default user
TcpIp Security | Windows NT TCP/IP security not enabled
Trusted Domain | Windows NT trusted domain
Trusted Host | Trusted host(s) found
Unknown NT Service | Unknown Windows NT service
messenger | Messenger service running
multihomed | Multihomed host
multiprotocol | Multiple protocols active
nt3.51Vuln | Samba .. Bug
ntrlogin | Windows NT rlogin service installed
perfmon | Performance Monitor readable
rcmd | Windows NT rcmd service running
registry | Windows NT registry opened remotely
rexec | Windows NT rexec service running
schedule | Windows NT schedule service running
High
All Access NetBIOS share - Everyone | NetBIOS share full access by Everyone group
Disabled Account Blank Pwd | Disabled account has blank password
Disabled Account User Pwd | Disabled account username same as password
Domain Guest Blank Pwd | Domain Guest account has blank password
Domain Guest No Pwd | Domain Guest has no password
Domain Guest User Pwd | Domain Guest username same as password
Guessed Disabled Account Pwd | Disabled account password guessed
Guessed Domain Guest Pwd | Domain Guest password guessed
LM security | LAN Manager security
NT 4.0 SP3 | Windows NT 4.0 prior to Service Pack 3
NT Beta | Windows NT 4.0 beta
Network Monitor | Windows NT Network Monitor
NisdReserved | NISd is running over a non-reserved port
Service User | Windows NT service user
Trojan Key Permissions | Windows NT trojan key permissions
Writable HKEY_LOCAL - non-admin | HKEY_LOCAL_MACHINE writable by non-administrators
Writeable HKEY_CLASSES - everyone | HKEY_CLASSES_ROOT writable by Everyone
guessedguestpw | Guest password guessed
nisdom | NIS server and domain names
nistcp | NIS password guessed via TCP
nisudp | NIS password guessed via UDP
pwlen | Minimum password length insufficient
regfile | Regedit is associated with .reg files
regfile - permissions | Regfile associations can be changed by non-administrators
registry - null session | Registry opened through a null session
scheduler permissions | Scheduler Key has incorrect permissions
winlogon permissions | Winlogon Key has incorrect permissions
winreg - everyone | Registry access allowed for all users