WINDOWS 98 CRITICAL UPDATES UPDATE
WINDOWS 98 CRITICAL UPDATES CODE

This article will not be posted until July 30. Microsoft Knowledge Base article 190288, SecHole lets Non-administrative Users Gain Debug Level Access https.

WINDOWS 98 CRITICAL UPDATES UPDATE

Microsoft Security Bulletin 98-009, Update Available for Windows NT Privilege Elevation attack (the Web-posted version of this bulletin),.

Please see the following references for more information related to this issue: Microsoft highly recommends that customers using Windows NT operating systems immediately apply the appropriate hot fixes to their systems. When it is available, will carry an announcement that provides the location of the fix. Microsoft has posted hot fixes to address this problem:įix for Microsoft Windows NT 4.0 x86 version - fixes-postSP3/priv-fix/privfixi.exeįix for Microsoft Windows NT 4.0 Alpha version - fixes-postSP3/priv-fix/privfixa.exeįix for Microsoft Windows NT 3.51 x86 version - fixes-postSP5/priv-fix/privfixi.exeįix for Microsoft Windows NT 3.51 Alpha version - fixes-postSP5/priv-fix/privfixa.exeįix for Microsoft Windows NT Server Terminal Server Edition, version 4.0 - This fix will be released shortly.

Windows NT Server, Terminal Server Edition, version 4.0.

Windows NT Server versions 3.51 and 4.0.

Windows NT Workstation versions 3.51 and 4.0.The hot fixes listed below ensure that the access check to grant any rights is done correctly by the server. This thread will add the user running the program to the local administrators group.

WINDOWS 98 CRITICAL UPDATES CODE

Creates a thread in the victim process that runs code from an accompanying dynamic-link library (DLL).The server-side component of DebugActiveProcess does not correctly check for valid access to the target process.

Iterates through the processes running as local system, calling DebugActiveProcess on each until a successful attach is performed.

Modifies the instructions at that address to return success in a failure case.

Locates the memory address of a particular API function used by the DebugActiveProcess function.

Specifically, the exploit program does the following: In this attack, a non-administrative user obtains administrative access to the system by virtue of being able to gain debug-level access on a system process. The attack cannot be used over the network to get domain administrative privileges remotely. Sensitive systems such as the Windows NT Domain Controllers, where non-administrative users do not have any local logon rights by default, are not susceptible to this threat. Normally this means they must have physical access to the computer in order to logon locally to the system. In order to perform this attack the user has to have a valid local account on the system and be able to run arbitrary code on the system. This exploit can potentially allow a non-administrative user to gain local administrative access to the system and thereby elevate his or her privileges on the system. The purpose of this bulletin is to inform Microsoft customers of this issue, its applicability to Microsoft products, and the availability of countermeasures Microsoft has developed to further secure its customers. Using this program, the non-administrative user is able to run arbitrary code in the system security context and thereby grant himself or herself local administrative privileges on the local system. Sechole.exe performs a sophisticated set of steps to allow a non-administrative user who is logged on locally (at the console of a system) to gain debug-level access on a system process. A program called sechole.exe written by Prasad Dabak, Sandeep Phadke and Milind Borate (, and ) exploits this vulnerability, and was published on the Internet. Recently Microsoft was notified by Mark Joseph Edwards ( ) of a Privilege Elevation vulnerability on Microsoft® Windows NT® operating system. Security Bulletin Microsoft Security Bulletin MS98-009 - Critical Update Available for Windows NT Privilege Elevation Attack

Windows 98 critical updates