NT LsaLookupSids() DoS Vulnerability

Bugtraq ID:	875
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Dec 16 1999 12:00AM
Updated:	Dec 16 1999 12:00AM
Credit:	Discovered by Anthony Osborne of the Security Labs at Network Associates, and published in a NAI advisory released December 16, 1999.
Vulnerable:	Microsoft Windows NT 4.0 SP6 + Microsoft Windows NT Enterprise Server 4.0 SP6 + Microsoft Windows NT Enterprise Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Workstation 4.0 SP6 + Microsoft Windows NT Workstation 4.0 SP6 Microsoft Windows NT 4.0 SP5 + Microsoft Windows NT Enterprise Server 4.0 SP5 + Microsoft Windows NT Enterprise Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Workstation 4.0 SP5 + Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT 4.0 SP4 + Microsoft Windows NT Enterprise Server 4.0 SP4 + Microsoft Windows NT Enterprise Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Workstation 4.0 SP4 + Microsoft Windows NT Workstation 4.0 SP4 Microsoft Windows NT 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT 4.0 SP2 + Microsoft Windows NT Enterprise Server 4.0 SP2 + Microsoft Windows NT Enterprise Server 4.0 SP2 + Microsoft Windows NT Server 4.0 SP2 + Microsoft Windows NT Server 4.0 SP2 + Microsoft Windows NT Terminal Server 4.0 SP2 + Microsoft Windows NT Terminal Server 4.0 SP2 + Microsoft Windows NT Workstation 4.0 SP2 + Microsoft Windows NT Workstation 4.0 SP2 Microsoft Windows NT 4.0 SP1 + Microsoft Windows NT Enterprise Server 4.0 SP1 + Microsoft Windows NT Enterprise Server 4.0 SP1 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Workstation 4.0 SP1 + Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0
Not Vulnerable:

NT LsaLookupSids() DoS Vulnerability

The LsaLookupSids() function (part of the LSA API) in Windows NT 4.0, if passed an invalid argument, can be made to force the LSASS.exe process to crash. Without a functional LSA, the system will be unable to handle logons, logoffs, and most other operations involving user authentication. To restore normal operation, the affected system needs to be rebooted.

NT LsaLookupSids() DoS Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

NT LsaLookupSids() DoS Vulnerability

Solution:
Microsoft has released a patch, available at:

x86:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16798

Alpha:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16799

NT LsaLookupSids() DoS Vulnerability

References:

• Microsoft Security Bulletin MS99-057: Frequently Asked Questions (Microsoft)
  
• Q248185: SID Enumeration Function in LSA may not Handle Argument Properly (Microsoft)