[原文]The Protected Store in Windows 2000 does not properly select the strongest encryption when available, which causes it to use a default of 40-bit encryption instead of 56-bit DES encryption, aka the "Protected Store Key Length" vulnerability.
Windows 2000的保护存储无法选择最强的可用加密。此漏洞导致使用默认40位加密而不是56位加密，又称为"Protected Store Key Length"漏洞。
Microsoft has released the following patch which rectifies this vulnerability. It was originally released on June 1. Microsoft released an updated patch on July 26 in order to fix a regression error : Microsoft Windows 2000 Professional
Publicized in a Microsoft Security Bulletin (MS00-032) on June 1, 2000.
Microsoft Windows 2000 Server
Avaya DefinityOne Media Servers
Avaya IP600 Media Servers
Avaya S3400 Message Application Server 0
Avaya S8100 Media Servers 0
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Advanced Server
Windows 2000 Protected Store uses a default 40-bit encryption instead of utilizing the stronger 56-bit DES encryption that it is shipped with, or 168-bit Triple DES (if Windows 2000 has been upgraded using the High Encryption Pack). A remote or local user who posesses full administrative rights can use decryption utilities against the weakly encrypted Protected Store in order to obtain user private keys.
Microsoft has released the following patch which rectifies this vulnerability. It was originally released on June 1. Microsoft released an updated patch on July 26 in order to fix a regression error :