Microsoft Windows 2000 Patch: Web Client NTLM Auth

Under specific conditions, this vulnerability allows a malicious Web site operator to obtain the cryptographically protected logon credentials of a visiting user. This is because the security settings for WEC components are set to incorrect levels, which allows your computer to send information about your authentication credentials to remote Web applications.

The vulnerability exists because WEC, which allows Internet Explorer to view and publish files via Web Folders, does not adhere to the recommended security settings in Internet Explorer, and performs NTLM authentication for any server that requests it. A malicious Web site operator could format a document to request NTLM authentication from a visiting user automatically, causing the users authentication credentials to be sent by default. Once the credentials are revealed, the operator may be able to use specialized tools to derive the users password.

Note This vulnerability affects only computers running versions of Internet Explorer later than 5.0 with Web Folders enabled. For more information about this vulnerability, read Microsoft Security Bulletin MS01-001.