CVE-1999-0200

Executive Summary

This report details CVE-1999-0200, a critical authentication bypass vulnerability in the FTP service (WFTPD) of Microsoft Windows NT 4.0. The vulnerability allows a remote, unauthenticated attacker to gain access to the FTP server using any arbitrary username and password. This condition is triggered by a specific, insecure server configuration: the local "Guest" account being enabled and having no password set. When an authentication attempt with invalid credentials is made, the FTP service incorrectly defaults to the context of the passwordless Guest account, granting the attacker access equivalent to that account's permissions.

Given that Windows NT 4.0 is long past its End-of-Life and is unsupported, no patch exists for this vulnerability. The CVSS score of 10.0 (CVSSv2) underscores the extreme severity. Immediate mitigation requires either disabling the Guest account, setting a strong password for it, or decommissioning the legacy system entirely.

CVSS Breakdown & Threat Level

The vulnerability is rated CRITICAL with a historical CVSSv2 score of 10.0. A modern CVSSv3.1 vector provides a more detailed breakdown, resulting in a score of 9.8.

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N): The vulnerability is exploitable remotely over any network, including the internet, as FTP is an internet-facing protocol.
• Attack Complexity: Low (AC:L): No specialized conditions or techniques are required. An attacker only needs a standard FTP client and knowledge of the target's IP address.
• Privileges Required: None (PR:N): The attacker is unauthenticated before the exploit.
• User Interaction: None (UI:N): The exploit does not require any interaction from a legitimate user.
• Scope: Unchanged (S:U): The exploit grants access to the FTP service but does not directly compromise other components or scopes on the system.
• Confidentiality: High (C:H): The attacker can read any files accessible to the Guest account, which could include sensitive information depending on file system permissions.
• Integrity: High (I:H): The attacker can create, modify, or delete any files where the Guest account has write permissions.
• Availability: High (A:H): The attacker can fill up disk space, delete critical files accessible to the Guest, or otherwise disrupt the availability of the FTP service and stored data.

Deep Dive & Mechanics

The vulnerability stems from a flawed logic path in how the Windows NT 4.0 FTP service handles authentication failures. The service is tightly integrated with the underlying Windows NT Security Account Manager (SAM).

The exploitation process follows these steps:

1. An attacker attempts to connect to the target FTP server.
2. The attacker provides any non-existent or incorrect username and password combination.
3. The FTP service attempts to validate these credentials against the local SAM database and fails.
4. Instead of rejecting the connection outright, the service checks the status of the built-in "Guest" account.
5. If the Guest account is enabled and has a blank password, the service's logic grants the session the security context of the Guest account.
6. The FTP server returns a 230 User logged in, proceed. message, confirming a successful login. The attacker is now authenticated as "Guest" and inherits all its file system permissions (reads, writes, deletes).

This behavior effectively turns the FTP service into an anonymous-access server, but with a deceptive authentication prompt that accepts any input. This can lead to unauthorized data access, modification, and potential staging point for further attacks on the internal network.

Vulnerable vs. Patched Code

As Windows NT 4.0 is a closed-source, End-of-Life operating system, a direct source code comparison is not possible. The vulnerability is behavioral and configuration-dependent.

Vulnerable Behavior (Guest account enabled, no password):

• FTP Client sends USER fakeuser
• FTP Server responds 331 Password required for fakeuser.
• FTP Client sends PASS fakepassword
• FTP Server (incorrectly authenticates as Guest) responds 230 User logged in, proceed.

Secure Behavior (Guest account disabled or has a password):

• FTP Client sends USER fakeuser
• FTP Server responds 331 Password required for fakeuser.
• FTP Client sends PASS fakepassword
• FTP Server (correctly fails authentication) responds 530 User cannot log in.

The fundamental flaw is not a buffer overflow or memory corruption, but a logical error in the authentication fallback mechanism.

Exploitation & Lab Setup

Exploitation is trivial and requires only a standard command-line FTP client.

Lab Setup:

1. Install Windows NT 4.0 Server in a virtual machine.
2. Install the IIS 4.0 component, which includes the FTP service.
3. In User Manager (lusrmgr.msc), ensure the "Guest" account is enabled (not disabled) and uncheck "User must change password at next logon".
4. Set a blank password for the Guest account.
5. Start the FTP service.

Exploitation Steps: Open a terminal on an attacker machine and use a standard FTP client.

# Connect to the vulnerable server
$ ftp 192.168.1.100

Connected to 192.168.1.100.
220 Microsoft FTP Service
Name (192.168.1.100:user): notarealuser
331 Password required for notarealuser.
Password: anypasswordwilldo
230 User logged in, proceed.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
# File listing appears here, based on Guest account permissions
226 Transfer complete.
ftp> quit
221

This successful login demonstrates the vulnerability, granting the attacker interactive access to the server's file system within the security context of the Guest account.

Detection Engineering

Detection can be achieved by monitoring network traffic for the specific banner of the vulnerable service and subsequent successful logins. A Suricata rule is highly effective for this purpose.

The following rule alerts on any successful FTP login to a server identifying as a "Microsoft FTP Service", which is characteristic of the vulnerable software. While this may generate false positives on secured Microsoft FTP servers, it is an essential investigative trigger for environments where legacy systems like Windows NT might still exist.

alert tcp any any -> any 21 ( \
  msg:"ET EXPLOIT Possible CVE-1999-0200 Windows NT FTP Login Bypass"; \
  flow:to_server,established; \
  content:"220 Microsoft FTP Service"; \
  flowbits:set,ftp.msft.banner; \
  flowbits:noalert; \
  classtype:attempted-admin; \
  sid:19990200; rev:1; \
)

alert tcp any 21 -> any any ( \
  msg:"ET EXPLOIT CVE-1999-0200 Windows NT FTP Login Bypass Success"; \
  flow:to_client,established; \
  flowbits:isnotset,ftp.login.success; \
  flowbits:isset,ftp.msft.banner; \
  content:"230 User"; \
  pcre:"/^230 User\s+.*\s+logged in/"; \
  flowbits:set,ftp.login.success; \
  reference:cve,1999-0200; \
  classtype:successful-admin; \
  sid:19990201; rev:1; \
)

Rule Logic:

1. Rule 1 (sid:19990200): Identifies a connection to an FTP server that presents the "Microsoft FTP Service" banner. It sets a flowbit (ftp.msft.banner) to track this session but does not alert.
2. Rule 2 (sid:19990201): Triggers an alert if it sees a "230 User...logged in" success message from the server within the same session that the first rule identified. This indicates a successful login to a potentially vulnerable FTP server, warranting immediate investigation.

Remediation & Mitigation

As Windows NT 4.0 is an End-of-Life product, no official patch will be released. The primary recommendation is to decommission the system. If decommissioning is not immediately possible, apply the following mitigations in order of priority:

1. Decommission the System (Highest Priority): The most effective solution is to migrate services from the Windows NT 4.0 server to a modern, supported operating system. Windows NT 4.0 contains numerous unpatched and critical vulnerabilities beyond this one and should not be connected to any network.

2. Disable or Secure the Guest Account: This is the direct mitigation for this specific CVE.

   • Option A (Recommended): Disable the Guest Account. In User Manager, right-click the "Guest" account and select "Properties", then check the "Account is disabled" box.
   • Option B: Set a Strong Password. If the Guest account is required for some legacy purpose, set a long, complex, and unique password for it. A passwordless Guest account is the root cause of this vulnerability.

3. Disable the FTP Service: If FTP functionality is not essential for the server's operation, stop and disable the FTP Publishing Service via the Services control panel (services.msc).

4. Implement Network Segmentation: Use a firewall to restrict all access to TCP port 21 on the vulnerable server. Only allow connections from specific, trusted IP addresses that absolutely require FTP access. This is a compensating control and does not fix the underlying vulnerability but reduces its attack surface.

[!] This Threat Intelligence report was automatically generated by Valters IT (valtersit.com) Neural Engine.

{/* [Security Hash: 048BDBEFDE7FC2B012B6E9E0] */}