BID:234

NT Known DLL Cache Vulnerability

Info

NT Known DLL Cache Vulnerability

Bugtraq ID:	234
Class:	Design Error
CVE:
Remote:	Unknown
Local:	Yes
Published:	Feb 18 1999 12:00AM
Updated:	Feb 18 1999 12:00AM
Credit:	This vulnerability was identified by the L0pht.
Vulnerable:	Microsoft Windows NT 3.5.1 Microsoft Windows NT 4.0 SP4 + Microsoft Windows NT Enterprise Server 4.0 SP4 + Microsoft Windows NT Enterprise Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Workstation 4.0 SP4 + Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT 4.0 SP2 + Microsoft Windows NT Enterprise Server 4.0 SP2 + Microsoft Windows NT Enterprise Server 4.0 SP2 + Microsoft Windows NT Server 4.0 SP2 + Microsoft Windows NT Server 4.0 SP2 + Microsoft Windows NT Terminal Server 4.0 SP2 + Microsoft Windows NT Terminal Server 4.0 SP2 + Microsoft Windows NT Workstation 4.0 SP2 + Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT 4.0 SP1 + Microsoft Windows NT Enterprise Server 4.0 SP1 + Microsoft Windows NT Enterprise Server 4.0 SP1 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Workstation 4.0 SP1 + Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0 Microsoft Windows NT 3.5

Not Vulnerable:	Microsoft Windows NT 4.0 SP5 + Microsoft Windows NT Enterprise Server 4.0 SP5 + Microsoft Windows NT Enterprise Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Workstation 4.0 SP5 + Microsoft Windows NT Workstation 4.0 SP5

Discussion

NT Known DLL Cache Vulnerability

The names and mappings of kernel objects in NT are cached in the "object namespace". In this area, DLL mappings are kept in a section called KnownDlls. By manipulating the namespace, it is possible to redirect calls to arbitrary dlls.

Exploit / POC

NT Known DLL Cache Vulnerability

x

/data/vulnerabilities/exploits/hackdllsrc.zip

Solution / Fix

NT Known DLL Cache Vulnerability

Solution:
Microsoft has issued an NT 4.0 Post Service Pack 4 patch for this vulnerability. It is located at:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP4/Smss-fix/

A hotfix for NT 3.51 has been created but has not been publicly released. Contact Microsoft to obtain this fix.

A hotfix for Terminal Server Service Pack 3 has been released:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40TSE/hotfixes-postSP3/Smss-fix/

This vulnerability has been patched in NT 4.0 Service Pack 5 and Terminal Server Service Pack 4.