发布时间 :1997-01-01 00:00:00
修订时间 :2008-09-09 08:34:39

[原文]A Windows NT local user or administrator account has a guessable password.

[CNNVD]Windows NT加密漏洞(CNNVD-199701-006)

        Windows NT存在漏洞。本地用户或者管理账户有一个可推测密码。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:microsoft:windows_2000Microsoft Windows 2000
cpe:/o:microsoft:windows_ntMicrosoft Windows NT

- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源

- 漏洞信息

Windows NT加密漏洞
高危 未知
1997-01-01 00:00:00 2005-10-20 00:00:00
        Windows NT存在漏洞。本地用户或者管理账户有一个可推测密码。

- 公告与补丁


- 漏洞信息

Microsoft Windows Password Authentication Security Point of Failure
Local Access Required, Remote / Network Access Authentication Management
Loss of Confidentiality, Loss of Integrity, Loss of Availability
Exploit Public, Exploit Commercial

- 漏洞描述

Passwords are a cornerstone of computer security. Virtually every sensitive computer resource requires one or more passwords to access it in any context. Most virtual authentication methods are based on some form of password, or security token. Given that passwords are chosen by the user, who tends to pick words easily remembered, along with poor password implementation, weak passwords are a common method for network intrusion. Despite decades of reliance upon these passwords, systems still ship with no password, easily guessed passwords, or no mechanisms to force users to maintain strong passwords. This often leads to passwords that are weak and easy to compromise.

- 时间线

1999-01-01 Unknow
Unknow Unknow

- 解决方案

While it is an accepted fact of security that any password can be guessed given sufficient resources, every organization should attempt to maintain strong passwords to deter and delay such compromises. The following measures can be taken to help in this process: 1. Passwords should be sufficiently complex: a. Be at least eight characters in length b. Contain upper case, lower case, and special characters c. Not be a word in any language or found in any dictionary d. Not bear any resemblence to the user, family, pets, etc. 2. Enforce password history. Ensure users must pick a new unique password and can not re-use old passwords. 3. Maximum password age. After a set amount of time (recommended 30 - 90 days), the password should expire and force users to select a new one. 4. Test password security by attempting to "crack" passwords. Only do so with written permission from a CEO/CSO/CxO. 5. Ensure users are educated on password security and the importance of passwords. This includes training on what not to do regarding passwords (ie: share them, write them down).

- 相关参考

- 漏洞作者

Unknown or Incomplete