MS Windows NT

General Synopsis - An account created by NT is called Everyone. This has the potential of the following:

1. Any Default Installation of Windows NT Workstation (v 3.51, 4.0) is vulnerable:
- the flaw allows the creation of a new entry in the registry which describes a new drive share with access granted to Everyone.
- a potential intruder can then wait for the system to reboot
- after reboot the new share is published on the network to Everyone. By sharing system drive one can obtain a copy of a password file updated by rdisk -s from the %SYSTEMROOT%\Repair directory, etc.

2. Any Default Installation of Windows NT Server or Workstation (v 4.0) is vulnerable:
- the flaw allows the creation of a new entry in the registry which describes a reference to a Trojan horse program located on the intruder's computer e.g. \\xxx.xxx.xxx.xxx\Share\Smth.exe
- potential intruder can then wait for an interactive logon
- after the user logs on to the server the Trojan horse program is executed. Obviously, the Trojan horse program could do about anything if the logged user is an Administrator. The Trojan can create a share (see above) if the logged user has guest or ordinary user privileges.

General Solution - Remove the account Everyone from your system. This includes any access rights granted and recorded within the system registry. You must also insure that the Permissions are changed and propagated to all your NT computers.