CVE-1999-0549

Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.

Windows NT 4.0 and Windows 2000 hosts allow remote attackers to cause a denial of service (unavailable connections) by sending multiple SMB SMBnegprots requests but not reading the response that is sent back.

The Cenroll ActiveX control (xenroll.dll) for Terminal Server Editions of Windows NT 4.0 and Windows NT Server 4.0 before SP6 allows remote attackers to cause a denial of service (resource consumption) by creating a large number of arbitrary files on the target machine.

Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, allowing remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data.

GINA in Windows NT 4.0 allows attackers with physical access to display a portion of the clipboard of the user who has locked the workstation by pasting (CTRL-V) the contents into the username prompt.

Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as a Routing Information Field (RIF) field with a hop count greater than 7 or a list containing duplicate Token Ring IDs.

Windows NT with SYSKEY reuses the keystream used for encrypting SAM password hashes, allowing an attacker to crack passwords.

Windows NT improperly downloads a system policy if the domain user logs into the domain with a space at the end of the domain name.

LSA (LSASS.EXE) in Windows NT 4.0 allows remote attackers to cause a denial of service via a NULL policy handle in calls to SamrOpenDomain, SamrEnumDomainUsers, and SamrQueryDomainInfo.

Windows NT 4.0 generates predictable random TCP initial sequence numbers (ISN), allowing remote attackers to perform spoofing and session hijacking.