CVE-2003-0910

Vulnerability

A vulnerability in the NtSetLdtEntries function of the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows a local attacker to gain access to kernel memory and execute arbitrary code [1][2]. The issue arises when the function fails to properly validate an expand-down data segment descriptor that points to protected memory. Affected versions include Windows NT Workstation 4.0 Service Pack 6a, Windows NT Server 4.0 Service Pack 6a, Windows NT Server 4.0 Terminal Server Edition Service Pack 6, and Windows 2000 Service Pack 2/3/4 [1].

Exploitation

An attacker must have local access to the system and the ability to call the NtSetLdtEntries API with a specially crafted descriptor. Exploitation requires no user interaction beyond the attacker's own actions, as the function is exposed to user-mode processes [2]. The attacker supplies an expand-down data segment descriptor that references kernel memory, bypassing the intended access controls.

Impact

Successful exploitation allows a local attacker to execute arbitrary code in the kernel context, gaining full control over the system [1][2]. This includes the ability to read and write kernel memory, elevate privileges to the highest level (SYSTEM), and compromise the confidentiality, integrity, and availability of the entire operating system.

Mitigation

Microsoft released a security update as part of MS04-011 on April 13, 2004, which fixes the vulnerability [1]. The update is available for all affected versions of Windows NT 4.0 and Windows 2000. No workaround is listed; applying the update is the only recommended mitigation. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities Catalog.