CVE-ID

CVE-2001-0350

• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Microsoft Windows 2000 telnet service creates named pipes with predictable names and does not properly verify them, which allows local users to execute arbitrary commands by creating a named pipe with the predictable name and associating a malicious program with it, the second of two variants of this vulnerability.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Assigning CNA
MITRE Corporation
Date Record Created
20010516 Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Modified (20050509)
Votes (Legacy)
ACCEPT(5) Armstrong, Balinsky, Cole, Foat, Ziese
MODIFY(1) Frech
RECAST(1) Stracener
REVIEWING(2) Christey, Wall
Comments (Legacy)
 Wall> Perhaps merge 0349 and 0350 unless there is a bigger difference.
 Stracener> Merge this with 0349.
 Frech> XF:win2k-telnet-pipe-privileges(6664)
 Christey> CIAC:L-092
   URL:http://www.ciac.org/ciac/bulletins/l-092.shtml
 CHANGE> [Christey changed vote from NOOP to REVIEWING]
 Christey> CERT-VN:VU#587587
   URL:http://www.kb.cert.org/vuls/id/587587
   BID:2849
   Microsoft identifies two separate vulnerabilities that are extremely
   similar, but the security bulletin states that "The two
   vulnerabilities differ primarily in the way they exploit the
   underlying problem regarding named pipe creation."  So, it may be
   necessary to merge CVE-2001-0350 with CVE-2001-0349.
   
   If one issue is because of predictable names, and another
   issue is because pipe ownership isn't properly verified, then
   these could stay SPLIT, and the descriptions should be
   modified accordingly.

Proposed (Legacy)
20010727
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.