Article ID: 218473 - View products that this article applies to.
This article was previously published under Q218473
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/256986/EN-US/ )Description of the Microsoft Windows Registry
If a non-administrative level user logs on interactively to your computer, it may be possible for the user to gain local administrative privileges. A user may load a non-Microsoft dynamic-link library (DLL) into memory having the same name as a core operating system DLL and then programmatically change the entry in the KnownDLLs list to point to the malicious copy. Programs then requesting the system DLL will instead be directed to the malicious copy. When called by a program with sufficiently high security privileges, it may be possible to bypass typical security related activities such as adding a user to the Local Administrators group. A remote user may also submit an arbitrary program to run on your computer to exploit this vulnerability.
In Windows NT, core operating system DLLs are kept in virtual memory and shared between programs. This prevents redundant copies of the DLL in memory, and improves memory usage and system performance. When a program calls a function provided by one of these DLLs, the operating system refers to a data structure called the KnownDLLs list to determine the location of the DLL in virtual memory. The Windows NT security architecture protects in-memory DLLs against modification, but by default it allows all users to read/write access to the KnownDLLs list.
This vulnerability is only local to the computer where a malicious user is logged on interactively. For example, a workstation user could exploit this vulnerability to become a local administrator, but cannot use it directly to become a domain administrator. This restricts the impact of this issue as non-administrative users are not granted the ability to interactively log on to servers (following recommended Microsoft security practices).
NOTE: You should apply this fix to all systems that allow non-privileged users to log in to them.
Windows NT 4.0To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the individual software update. For information on obtaining the latest service pack, please go to:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMSThis hotfix has been posted to the following Internet location as Smssfixi.exe (x86) and Smssfixa.exe (Alpha):
Windows NT Server 4.0, Terminal Server EditionTo resolve this problem, obtain the latest service pack for Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
152734This hotfix has been posted to the following Internet location as Smssfixi.exe (x86) and Smssfixa.exe (Alpha):
(http://support.microsoft.com/kb/152734/EN-US/ )How to Obtain the Latest Windows NT 4.0 Service Pack
Windows NT 3.51A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.
To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=supportNote In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
The English version of this fix should have the following file attributes or later:
Date Time Size File name Platform ------------------------------------------------------------- 03/24/99 09:56p 37,328 Smss.exe (x86) 03/24/99 09:59p 54,544 Smss.exe (Alpha)
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To work around this issue, enable stronger protection on system base objects such as the KnownDLLs list by doing the following:
Microsoft has confirmed that this problem may result in some degree of security vulnerability in the Microsoft products listed at the beginning of this article.
This problem was first corrected in Windows NT Server 4.0, Terminal Server Edition Service Pack 4. This problem was first corrected in Windows NT version 4.0 Service Pack 5.
For additional security related information about Microsoft products, please visit the Web site at:
Article ID: 218473 - Last Review: June 11, 2012 - Revision: 4.0