IBM GINA for NT 1.0 - Local Privilege Escalation

Author: Frank Pikelner
type: local
platform: windows
port: 
date_added: 1999-08-23 
date_updated: 2012-06-30 
verified: 1 
codes: CVE-1999-0718;OSVDB-9664 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/608/info

IBM has written a replacement GINA for Windows NT to allow NT hosts to authenticate against OS/2 domains. On machines running the modified GINA, the creation of a specific Registry key under HKLM\System\CurrentControlSet\Services\IBMNeTNT may allow a user to add any Group to the "Local Administrators" group upon next reboot. ACL permissions over this key allow non-administrators to create the necessary key and value.

Modify the following Registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBMNeTNT\GroupMapping

to include

Value Name: GroupName (where group name is the name of the group to add the the administrators group)
Data Type: Reg_SZ
String: Administrators

Reboot the host.