Windows NT vulnerabilities

Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, allowing remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data.

Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as a Routing Information Field (RIF) field with a hop count greater than 7 or a list containing duplicate Token Ring IDs.

GINA in Windows NT 4.0 allows attackers with physical access to display a portion of the clipboard of the user who has locked the workstation by pasting (CTRL-V) the contents into the username prompt.

Windows NT with SYSKEY reuses the keystream used for encrypting SAM password hashes, allowing an attacker to crack passwords.

Windows NT improperly downloads a system policy if the domain user logs into the domain with a space at the end of the domain name.

LSA (LSASS.EXE) in Windows NT 4.0 allows remote attackers to cause a denial of service via a NULL policy handle in calls to SamrOpenDomain, SamrEnumDomainUsers, and SamrQueryDomainInfo.

Windows NT 4.0 generates predictable random TCP initial sequence numbers (ISN), allowing remote attackers to perform spoofing and session hijacking.

A Windows NT user can disable the keyboard or mouse by directly calling the IOCTLs which control them.

An attacker can conduct a denial of service in Windows NT by executing a program with a malformed file image header.

A system-critical Windows NT file or directory has inappropriate permissions, which may lead to unauthorized access or modification of data.

A Windows NT system's file audit policy does not log an event success or failure for non-critical files or directories.

The Windows NT system's registry audit policy does not log event successes or failures for non-critical registry keys.

Windows NT is not using a password filter utility, such as PASSFILT.DLL, which may lead to weaker password protection for users.

A Windows NT domain user or administrator account has a default, null, blank, or missing password.

Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed SMB logon request in which the actual data size does not match the specified size.

Windows NT 4.0 before SP3 allows remote attackers to bypass firewall restrictions or cause a denial of service (crash) by sending improperly fragmented IP packets without the first fragment, which the TCP/IP stack incorrectly reassembles into a valid session.

The Windows NT password policy has inappropriate security-critical settings, such as password length, password age, or uniqueness.

A local user or administrator account on Windows NT has a default, null, blank, or missing password.

The registry in Windows NT can be accessed remotely by users who are not administrators.

The file audit policy of a Windows NT system does not log event success or failure for security-critical files or directories.

Windows NT crashes or locks up when a Samba client executes a 'cd ..' command on a file share.

The user audit policy in Windows NT does not log event successes or failures, such as Logon and Logoff, File and Object Access, User and Group Management, Security Policy Changes, and System and Process Tracking.

A Windows NT account policy has inappropriate security-critical settings for lockout, such as lockout duration and the number of bad logon attempts, which may lead to unauthorized access.

The NewNTUnicodeString function does not check for string length overflow. When given a string exceeding the maximum NTUnicodeString size (16-bit byte count), it returns a truncated string instead of an error.

The default permissions for the Cryptography\Offload registry key in Windows NT 4.0 allow local users to compromise the cryptographic keys of other users.

After an unattended installation of Windows NT 4.0, an installation file could include sensitive information such as the local Administrator password.

Windows NT Autorun executes the autorun.inf file on non-removable media, allowing local attackers to specify an alternate program to execute when other users access a drive.

A Windows NT system does not clear the system page file during shutdown, which might allow sensitive information to be recorded.

The NtImpersonateClientOfPort local procedure call in Windows NT 4.0 allows local users to gain elevated privileges, known as 'Spoofed LPC Port Request.'

When the Ntconfig.pol file is used on a server whose name is longer than 13 characters, Windows NT does not properly enforce policies for global groups, which could allow users to bypass restrictions that were intended by those policies.

Windows NT 4.0 allows local users to cause a denial of service (crash) via an illegal kernel mode address to the functions GetThreadContext or SetThreadContext.

Windows NT 4.0 allows local users to cause a denial of service via a user mode application that closes a handle that was opened in kernel mode, which causes a crash when the kernel attempts to close the handle.

A Windows NT user can use SUBST to map a drive letter to a folder, which is not unmapped after the user logs off. This may allow that user to modify the location of folders accessed by later users.

Windows NT searches a user's home directory (%systemroot% by default) before other directories to find critical programs, which could allow local users to bypass access restrictions or gain privileges by placing a Trojan horse program into the root directory, which is writable by default.

The screen saver in Windows NT does not verify that its security context has been changed properly, allowing attackers to run programs with elevated privileges.

Local users in Windows NT can obtain administrator privileges by changing the KnownDLLs list to reference malicious programs.

There is a one-way or two-way trust relationship between Windows NT domains.

In Windows NT, an inappropriate user is a member of a group, such as Administrators, Backup Operators, Domain Admins, Domain Guests, Power Users, Print Operators, Replicators, System Operators, etc.

A Windows NT account policy does not forcibly disconnect remote users from the server when their logon hours expire.

A Windows NT log file has an inappropriate maximum size or retention period.

Windows NT automatically logs in an administrator upon rebooting.

A critical Windows NT registry key has an inappropriate value.

The default setting for the Winlogon key entry ShutdownWithoutLogon in Windows NT allows users with physical access to shut down a Windows NT system without logging in.

A Windows NT system does not restrict access to removable media drives such as a floppy disk drive or CDROM drive.

The Windows NT system's registry audit policy does not log event successes or failures for security-critical registry keys.

The Logon box of a Windows NT system displays the name of the last user who logged in.

The Windows NT guest account is enabled, which may lead to unauthorized access to the system.

A Windows NT domain user or administrator account has a guessable password.

The PATH in Windows NT includes the current working directory (.), which could allow local users to gain privileges by placing Trojan horse programs with the same name as commonly used system programs into certain directories.

A local user or administrator account in Windows NT has a guessable password.