NT LPC Privilege Escalation Vulnerability
BID:934
Info
NT LPC Privilege Escalation Vulnerability
| Bugtraq ID: | 934 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 13 2000 12:00AM |
| Updated: | Jan 13 2000 12:00AM |
| Credit: | This vulnerability was first published in a Bindview advisory released on January 13, 2000 and posted to Bugtraq on January 14, 2000. |
| Vulnerable: |
Microsoft Windows NT 4.0 SP6 Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 |
| Not Vulnerable: |
Microsoft Windows NT 3.5.1 Microsoft Windows 2000 Professional |
Discussion
NT LPC Privilege Escalation Vulnerability
Windows NT has an undocumented facility called Local Procedure Call (LPC) that allows user programs to communicate with the Windows NT subsystems. Typically, the subsystem runs as a server thread which services requests from client threads.
LPC API function called NtImpersonateClientOfPort() allows a server thread to assume the credentials of the client thread which is making a request. Due to insufficient validation of the identity of the calling thread, it is possible to spoof a request and impersonate any unrelated thread as well as the security context of this thread.
A local attacker can take advantage of this by creating both the server and client threads and calling this function with spoofed arguments from the server thread. The server thread will then assume the identity and security context of the spoofed thread. Since an attacker can impersonate any running thread, it is possible to assume system privileges from a regular user account.
Windows NT has an undocumented facility called Local Procedure Call (LPC) that allows user programs to communicate with the Windows NT subsystems. Typically, the subsystem runs as a server thread which services requests from client threads.
LPC API function called NtImpersonateClientOfPort() allows a server thread to assume the credentials of the client thread which is making a request. Due to insufficient validation of the identity of the calling thread, it is possible to spoof a request and impersonate any unrelated thread as well as the security context of this thread.
A local attacker can take advantage of this by creating both the server and client threads and calling this function with spoofed arguments from the server thread. The server thread will then assume the identity and security context of the spoofed thread. Since an attacker can impersonate any running thread, it is possible to assume system privileges from a regular user account.
Exploit / POC
NT LPC Privilege Escalation Vulnerability
Currently the SecurityFocus staff are not aware of any public exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any public exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
NT LPC Privilege Escalation Vulnerability
Solution:
Microsoft has released a hotfix, available at:
Intel:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17382
Alpha:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17383
Solution:
Microsoft has released a hotfix, available at:
Intel:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17382
Alpha:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17383
References
NT LPC Privilege Escalation Vulnerability
References:
References: