Restricting Changes to Base System Objects (218473)

SYMPTOMS

If a non-administrative level user logs on interactively to your computer, it may be possible for the user to gain local administrative privileges. A user may load a non-Microsoft dynamic-link library (DLL) into memory having the same name as a core operating system DLL and then programmatically change the entry in the KnownDLLs list to point to the malicious copy. Programs then requesting the system DLL will instead be directed to the malicious copy. When called by a program with sufficiently high security privileges, it may be possible to bypass typical security related activities such as adding a user to the Local Administrators group. A remote user may also submit an arbitrary program to run on your computer to exploit this vulnerability.

CAUSE

In Windows NT, core operating system DLLs are kept in virtual memory and shared between programs. This prevents redundant copies of the DLL in memory, and improves memory usage and system performance. When a program calls a function provided by one of these DLLs, the operating system refers to a data structure called the KnownDLLs list to determine the location of the DLL in virtual memory. The Windows NT security architecture protects in-memory DLLs against modification, but by default it allows all users to read/write access to the KnownDLLs list.

This vulnerability is only local to the computer where a malicious user is logged on interactively. For example, a workstation user could exploit this vulnerability to become a local administrator, but cannot use it directly to become a domain administrator. This restricts the impact of this issue as non-administrative users are not granted the ability to interactively log on to servers (following recommended Microsoft security practices).

RESOLUTION

NOTE: You should apply this fix to all systems that allow non-privileged users to log in to them.

Windows NT 4.0

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the individual software update. For information on obtaining the latest service pack, please go to:

http://www.microsoft.com/windows/servicepacks/ -or-
152734 how to obtain the latest windows nt 4.0 service pack

For information on obtaining the individual software update, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://support.microsoft.com/directory/overview.asp

This hotfix has been posted to the following Internet location as Smssfixi.exe (x86) and Smssfixa.exe (Alpha):

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp4/smss-fix/

Windows NT Server 4.0, Terminal Server Edition

To resolve this problem, obtain the latest service pack for Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack

This hotfix has been posted to the following Internet location as Smssfixi.exe (x86) and Smssfixa.exe (Alpha):

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40tse/hotfixes-postsp3/smss-fix/

Windows NT 3.51

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix should have the following file attributes or later:

   Date      Time                 Size    File name     Platform
   -------------------------------------------------------------
   03/24/99  09:56p                37,328 Smss.exe      (x86)
   03/24/99  09:59p                54,544 Smss.exe      (Alpha)

WORKAROUND

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To work around this issue, enable stronger protection on system base objects such as the KnownDLLs list by doing the following:

Click Start, click Run, type regedt32, and then click OK.
On the Windows menu, click HKEY_LOCAL_ MACHINE on Local Machine.
Double-click the \System\CurrentControlSet\Control\Session Manager folder.
On the Edit menu, click Add Value, type ProtectionMode, click REG_DWORD in the Data Type box, and then click OK.
Type 1 in the Data box, and then click OK.
Quit Registry Editor, and then restart the computer.