Microsoft has released three post-SP4 hot-fixes for Windows NT 4.0 this week. The hot-fixes include:
- Screen Saver Vulnerability Lets User Privileges be Elevated
Windows NT starts a screen saver in the local system context and then immediately changes the context to match that of the logged on user. However, Windows NT does not verify that this change completed successfully. If the change fails, the screen saver is running in a privileged state which permits a specially programmed screen saver to use these privileges to elevate the security of the logged on user.
- Mfc40.dll Causes Programs to Display Wrong Date After 01/01/2000
An internal function within the system file Mfc40.dll is designed to add 1900 to every 2-digit date that is passed to it. For example, 99 is returned as 1999. If more than 2 digits are passed, nothing is added. Programs that use this function may incorrectly parse a date after the year 2000 (for example, January 1, 2000, may become January 1, 100).
- SNMP Agent Leaks Memory When Queried
Severe memory leakage occurs when the SNMP agent is under stress.