[原文]The SECEDIT command on Microsoft Windows 2000 before Update Rollup 1 for SP4, when using a security template to set Access Control Lists (ACLs) on folders, does not apply ACLs on folders that are listed after a long folder entry, which could result in less secure permissions than specified by the template.
Microsoft Windows 2000 SECEDIT Long Folder ACL Set Issue
Local Access Required
Loss of Integrity
Microsoft Windows 2000 SECEDIT utility contains a flaw that may not apply Access Control Lists (ACLs) on folders when using a security template to set ACLs. The issue is triggered when one of the folders that is listed in the security template has a long name (that includes the folder's path). It is possible that the flaw may allow the ACL to be set correctly on the folder with the long name, but does not apply ACLs on folders that are listed after the long folder entry, resulting in a loss of integrity.
Upgrade to Update Rollup 1 for Windows 2000 Service Pack 4 (SP4) package or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s):
Create a new security template for each folder that has a long name. If the list of folders in your security template includes folders that have long folder names, the first long folder name already has its ACL set. You can create a new security template for the subsequent folders.