Spoofed LPC Port Request Vulnerability

On a computer that is running Windows NT 4.0, it is possible for a malicious user to use a program that makes a specific local procedure call (LPC) to impersonate any other user who has local logon privileges and run any program, including programs that can run in the LocalSystem context.

Issue

LPC Ports is a facility that allows LPC calls on a machine. One of the functions in the LPC Ports API set enables, by design, a server thread to impersonate a client thread on the same machine. However, a flaw in the validation portion of the function would allow a malicious user to create both the client and server threads, and manipulate the impersonation request to allow it to run in the context of any desired user on the local machine, including the System itself.

The primary risk from this vulnerability is that a malicious user could exploit this vulnerability to gain additional privileges on the local machine. However, it also could be used to cause audit logs to indicate that certain actions were taken by another user. A malicious user would require the ability to log onto the target machine interactively and run arbitrary programs in order to exploit this vulnerability, and as a result, workstations and terminal servers would be at greatest risk.

Affected Products

• Windows NT Server, Enterprise, Terminal Server and Workstation 4.0

Download

Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17382

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: January 13, 2000

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<