Microsoft KB Archive/231457

= Malformed Request Causes LSA Service to Stop Responding =

Article ID: 231457

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Server 4.0, Terminal Server Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT 4.0 Service Pack 1
 * Microsoft Windows NT 4.0 Service Pack 2
 * Microsoft Windows NT 4.0 Service Pack 3
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT Server 4.0 Enterprise Edition
 * Microsoft Windows NT 4.0 Service Pack 4

-



This article was previously published under Q231457



SYMPTOMS
A specially malformed request to the Microsoft Local Security Authority (LSA) service may be used to exploit a security vulnerability on a computer running Windows NT. A user can abuse this vulnerability to run a program and cause a denial of service attack that may cause the LSA service to stop responding (hang) and require you to restart the computer. You may also receive the following error message:

Sorry! The Microsoft Exchange Server is down or the HTTP service has been disabled by an administrator. Please try your request again later.



CAUSE
Windows NT provides the ability to manage user privileges programmatically through the Local Security Authority (LSA) application programming interface (API). This API allows a program to query user names, modify privileges, and change other elements of the security policy, subject to the program's authorizations. Certain API methods do not correctly handle certain types of invalid arguments. If a call is made using a specially malformed argument, the LSA service may hang. The vulnerability is a denial of service threat only, and the LSA service can be restored by restarting the computer. This vulnerability cannot be used by unauthorized program to query or modify user information or privileges.



Windows NT Server or Workstation 4.0
To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the individual software update. For information on obtaining the latest service pack, please go to:


 * http://www.microsoft.com/windows/servicepacks/ -or-


 * 152734 how to obtain the latest windows nt 4.0 service pack

For information on obtaining the individual software update, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://support.microsoft.com/directory/overview.asp

NOTE: This fix can be installed on Windows NT 4.0 Service Pack 4 and Service Pack 5.

Windows NT Server 4.0, Terminal Server Edition
To resolve this problem, obtain the latest service pack for Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows NT Server version 4.0, Terminal Server Edition Service Pack 6.



MORE INFORMATION
For additional security-related information about Microsoft products, please visit:

http://www.microsoft.com/security/

Additional query words: MS99-020

Keywords: kbbug kbfix kbqfe kbprogramming kbhotfixserver KB231457

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.