NT Screensaver Vulnerability
BID:474
Info
NT Screensaver Vulnerability
| Bugtraq ID: | 474 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 10 1999 12:00AM |
| Updated: | Mar 10 1999 12:00AM |
| Credit: | Vulnerability exposed and exploit created by Cybermedia Software Private Limited. |
| Vulnerable: |
Microsoft Windows NT 3.5.1 SP5 Microsoft Windows NT 3.5.1 SP4 Microsoft Windows NT 3.5.1 SP3 Microsoft Windows NT 3.5.1 SP2 Microsoft Windows NT 3.5.1 SP1 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 |
| Not Vulnerable: |
Microsoft Windows NT 4.0 SP5 |
Discussion
NT Screensaver Vulnerability
When the computer is idle for the set time period (user definable) Winlogon.exe starts the screensaver. The screen saver process is selectable by the user. Winlogon.exe uses the CreateProcessAPI call to start the screen saver and immediately suspends it. At this point the screen saver is running with the security context of Winlogon.exe (system). Winlogon obtains the process handle, changes the primary security token of the screen saver to match the current user, and resumes the screen saver. Winlogon never verifies that the token change was successful. Therefore, a user could create an executable, set it as the screen saver, and should the security change fail it will run with full system-level privileges.
When the computer is idle for the set time period (user definable) Winlogon.exe starts the screensaver. The screen saver process is selectable by the user. Winlogon.exe uses the CreateProcessAPI call to start the screen saver and immediately suspends it. At this point the screen saver is running with the security context of Winlogon.exe (system). Winlogon obtains the process handle, changes the primary security token of the screen saver to match the current user, and resumes the screen saver. Winlogon never verifies that the token change was successful. Therefore, a user could create an executable, set it as the screen saver, and should the security change fail it will run with full system-level privileges.
References
NT Screensaver Vulnerability
References:
References:
- Screen Saver Vulnerability in Windows NT (Cybermedia Software Private Ltd.)