Jean-Baptiste Marchand has reported a weakness in Microsoft Windows 2000 and XP, which can be exploited by malicious people to gain knowledge of certain system information.

The weakness is caused due to an unspecified error in the process used for validating authentication information when clients establish anonymous logons using named pipe connections.

Successful exploitation discloses the usernames of users with an open connection to an available shared resource. On Windows 2000, successful exploitation allows enumeration of Windows services and discloses information of the Application and System eventlogs.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Jean-Baptiste Marchand, Herve Schauer Consultants.

Changelog
Further details available in Customer Area

Original Advisory
MS05-007 (KB888302):
http://www.microsoft.com/technet/security/bulletin/ms05-007.mspx

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area