Title: Trusting Domains Do Not Verify Domain Membership of SIDs in Authorization Data
Date: 30 January 2002
Software: Windows NT 4.0, Windows 2000
Impact: Privilege Elevation
Max Risk: Moderate
Bulletin: MS02-001
A vulnerability exists because the trusting domain does not verify that the trusted domain is actually authoritative for all the SIDs in the authorization data. If one of the SIDs in the list identified a user or security group that is not in the trusted domain, the trusting domain would accept the information and use it for subsequent access control decisions. If an attacker inserted SIDs of his choice into the authorization data at the trusted domain, he could elevate his privileges to those associated with any desired user or group, including the Domain Administrators group for the trusting domain. This would enable the attacker to gain full Domain Administrator access on computers in the trusting domain.