COMMAND

    rdisk

SYSTEMS AFFECTED

    - Microsoft Windows NT 4.0 Workstation
    - Microsoft Windows NT 4.0 Server
    - Microsoft Windows NT 4.0, Enterprise Edition
    - Microsoft Windows NT 4.0, Terminal Server Edition

PROBLEM

    Arne Vidstrom  found following.   There exist  a vulnerability  in
    rdisk  which  causes  the  contents  of  the  registry hives to be
    exposed to  Everyone during  updating of  the repair  info.   When
    rdisk updates  the repair  info it  uses a  temporary file  called
    $$hive$$.tmp, which it  puts in the  repair directory and  deletes
    when  it's  finished.   The  temporary  file  is used to store the
    contents  of  the  hives  during  the  update.  This is especially
    interesting on Terminal Server, so we'll take that as an example.

    The \Wtsrv\repair  directory contains  backups of  the hives,  but
    these have  the permissions:  Administrators -  Full Control,  and
    SYSTEM  -  Full  Control.   Hard  to  get  to  those...  but   the
    $$hive$$.tmp  file  is  a  different  thing.   Everybody  has Read
    permissions to it, so Everybody can get the contents of the  hives
    during update.  An ordinary user can leave a program running which
    checks for the temporary  file constantly, and copies  the content
    when it is created.  Of course many restrict access to the  repair
    directory  already,  but  either  way  this  is a vulnerability in
    rdisk.

SOLUTION

    Patch availability:

      Windows NT 4.0  Workstation; Windows NT  4.0 Server; Windows  NT
      4.0 Server, Enterprise Edition:
        - Intel: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17745
        - Alpha: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17747

      Windows NT 4.0 Server, Terminal Server Edition:
        - http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17384