VERSIONS AFFECTED
Microsoft Windows NT 4.0 Workstation
Microsoft Windows NT 4.0 Server
Microsoft Windows NT 4.0 Server, Enterprise Edition
Microsoft Windows NT 4.0 Server, Terminal Server Edition
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
DESCRIPTION
According to the discoverer,
Windows uses a specific search order for executables that are defined in the Registry. If
those definition use relative path names instead of absolute path names then it is
possible to cause a Trojan to run instead of the legimate execuatable. The search order
used is as follows:
- The directory where the calling application loaded from
The current directory of the parent process
The 32-bit Windows system directory: System32
The 16-bit Windows system directory: System
The Windows directory: %SYSTEMROOT%
The directories listed in the PATH environment variable
DEMONSTRATION
During the system boot
sequence, any file named EXPLORER.EXE located in the boot drives root directory will load instead of the legitimate
version, normally located in the %SYSTEMROOT% directory.
VENDOR RESPONSE
Microsoft released a FAQ,
Support Online article Q269049, as well as patches for Windows
2000 and NT 4.0.
CREDIT
Discovered by Alberto Argones