Executive brief
A vulnerability in Windows NT 4.0 allows a standard user to bypass security checks and gain full administrative control over the operating system. By exploiting a flaw in how the system handles process tokens, an attacker can elevate their privileges, potentially leading to unauthorized access to sensitive data, system-wide configuration changes, or the installation of malicious software. This issue, historically known as 'GetAdmin', represents a complete compromise of the local system's security model.
Technical details
This vulnerability, known as 'GetAdmin', is a privilege escalation flaw within the Windows NT 4.0 kernel. It occurs because the NtOpenProcessToken system call can be manipulated to succeed regardless of the calling user's actual permissions. A local attacker with standard user access can exploit this root cause to obtain a token with administrative privileges. This allows for a complete bypass of the operating system's access control mechanisms (CWE-264). The attack requires local access to the system but no special user interaction or prior administrative rights. Microsoft addressed this issue in legacy service packs for Windows NT 4.0.
Affected products
- Microsoft Windows NT 4.0
Timeline
- 1997-01-01: disclosed: Initial publication date in NVD record