Windows NTLM relaying attacks updated since 14.09.2000
Published:		24.04.2003
Source:		BUGTRAQ
SecurityVulns ID:		542
Type:		client
Level:		7/10
Description:		Some client program use NTLM authentication with user's permission without user request. It may leak to NTLM credentials and perform choosen challenge attack and comprometation of server's with client credentials by relaying NTLM request.

Affected:		MICROSOFT : Windows NT 4.0 Workstation
		MICROSOFT : Windows NT 4.0 Server
		MICROSOFT : Windows 2000 Server
		MICROSOFT : Windows 2000 Advanced Server
		MICROSOFT : Windows 2000 Professional
		MICROSOFT : Windows 98
		MICROSOFT : Windows 95
		MICROSOFT : Windows ME
		MICROSOFT : Windows XP

Original document		3APA3A, Outlook Express and SPA (Secure Password Authentication) (20.10.2001)
		seclab_(at)_ce.aut.ac.ir, Authentication flaw in microsoft SMB protocol (24.04.2003)
		L0PHT, @stake Advisory: NTLM Replaying via Windows 2000 Telnet Client (A 091400-1) (15.09.2000)
		MICROSOFT, Security Bulletin (MS00-067) (15.09.2000)
		monti, Win2k Telnet.exe malicious server vulnerability (14.09.2000)
		monti, Win2k Telnet.exe malicious server vulnerability (14.09.2000)

Files:		Exploit for "Authentication flaw in Windows SMB protocol"
		Server for Win2K telnet NTLM response interseption
		Prehashed NTLM challenge.
		NTLM Rogue Telnet Server (@Stake)
		Patch Win2K telnet NTLM Authentication
Discuss:		Read or add your comments to this news (0 comments)