Article ID: 218473
Article Last Modified on 11/1/2006
APPLIES TO
- Microsoft Windows NT Server 4.0, Terminal Server Edition
- Microsoft Windows NT Workstation 3.5
- Microsoft Windows NT Workstation 3.51
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Server 3.5
- Microsoft Windows NT Server 3.51
- Microsoft Windows NT Server 4.0 Standard Edition
- Microsoft Windows NT 4.0 Service Pack 1
- Microsoft Windows NT 4.0 Service Pack 2
- Microsoft Windows NT 4.0 Service Pack 3
- Microsoft Windows NT 4.0 Service Pack 4
- Microsoft Windows NT Server 4.0 Enterprise Edition
- Microsoft Windows NT 4.0 Service Pack 4
This article was previously published under Q218473
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SYMPTOMS
If a non-administrative level user logs on interactively to your computer, it may be possible for the user to gain local administrative privileges. A user may load a non-Microsoft dynamic-link library (DLL) into memory having the same name as a core operating system DLL and then programmatically change the entry in the KnownDLLs list to point to the malicious copy. Programs then requesting the system DLL will instead be directed to the malicious copy. When called by a program with sufficiently high security privileges, it may be possible to bypass typical security related activities such as adding a user to the Local Administrators group. A remote user may also submit an arbitrary program to run on your computer to exploit this vulnerability.
CAUSE
In Windows NT, core operating system DLLs are kept in virtual memory and shared between programs. This prevents redundant copies of the DLL in memory, and improves memory usage and system performance. When a program calls a function provided by one of these DLLs, the operating system refers to a data structure called the KnownDLLs list to determine the location of the DLL in virtual memory. The Windows NT security architecture protects in-memory DLLs against modification, but by default it allows all users to read/write access to the KnownDLLs list.
This vulnerability is only local to the computer where a malicious user is logged on interactively. For example, a workstation user could exploit this vulnerability to become a local administrator, but cannot use it directly to become a domain administrator. This restricts the impact of this issue as non-administrative users are not granted the ability to interactively log on to servers (following recommended Microsoft security practices).
RESOLUTION
NOTE: You should apply this fix to all systems that allow non-privileged users to log in to them.
Windows NT 4.0
To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the individual software update. For information on obtaining the latest service pack, please go to:
- 152734 how to obtain the latest windows nt 4.0 service pack
For information on obtaining the individual software update, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:
This hotfix has been posted to the following Internet location as Smssfixi.exe (x86) and Smssfixa.exe (Alpha):
Windows NT Server 4.0, Terminal Server Edition
To resolve this problem, obtain the latest service pack for Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack
This hotfix has been posted to the following Internet location as Smssfixi.exe (x86) and Smssfixa.exe (Alpha):
Windows NT 3.51
A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.
To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:
Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
The English version of this fix should have the following file attributes or later:
Date Time Size File name Platform
-------------------------------------------------------------
03/24/99 09:56p 37,328 Smss.exe (x86)
03/24/99 09:59p 54,544 Smss.exe (Alpha)
WORKAROUND
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To work around this issue, enable stronger protection on system base objects such as the KnownDLLs list by doing the following:
- Click Start, click Run, type regedt32, and then click OK.
- On the Windows menu, click HKEY_LOCAL_ MACHINE on Local Machine.
- Double-click the \System\CurrentControlSet\Control\Session Manager folder.
- On the Edit menu, click Add Value, type ProtectionMode, click REG_DWORD in the Data Type box, and then click OK.
- Type 1 in the Data box, and then click OK.
- Quit Registry Editor, and then restart the computer.
STATUS
Microsoft has confirmed that this problem may result in some degree of security vulnerability in the Microsoft products listed at the beginning of this article.
This problem was first corrected in Windows NT Server 4.0, Terminal Server Edition Service Pack 4. This problem was first corrected in Windows NT version 4.0 Service Pack 5.
MORE INFORMATION
For additional security related information about Microsoft products, please visit the Web site at:
Keywords: kbbug kbfix kbqfe kbhotfixserver KB218473
