VULHUB ™

The directories All Users and Default User are left world writable during an unattended install of Windows 2000 that has the option OEMPreinstall set to '1' in the answer file. A malicious user could insert a trojan into \{All Users}{Default User}\Start Menu\Programs\Startup which would be automatically executed once another user was to log onto the system. The aforementioned directories should only be writable by the Administrator and SYSTEM groups.

The directories All Users and Default User are left world writable during an unattended install of Windows 2000 that has the option OEMPreinstall set to '1' in the answer file. A malicious user could insert a trojan into \{All Users}{Default User}\Start Menu\Programs\Startup which would be automatically executed once another user was to log onto the system. The aforementioned directories should only be writable by the Administrator and SYSTEM groups.