Winobj.exe May Permit You to View Securable Objects Created or Opened by the Jet500.dll File

ID: Q243404

The information in this article applies to:

Microsoft Windows NT Server version 4.0
Microsoft Windows NT Server, Enterprise Edition version 4.0
Microsoft Windows NT Workstation version 4.0

SYMPTOMS

The following securable (event/semaphore/mutex) objects may exist on the system name space:

\BaseNameObjects\Proc Count:* (semaphore)

\BaseNamedObjects\Collect:* (semaphore)

\BaeNamedObjects\New Proc:* (mutex)

\BaeNamedObjects\Access:* (mutex)

\BaeNamedObjects\Done:* (event)

If these objects exist, they may be viewed by using Microsoft Object Viewer (Winobj.exe). In Windows NT 4.0 Service Pack 6a and earlier, these objects have NULL Access Control Lists (ACL), meaning that everyone has all access to these objects.

CAUSE

These objects are created and opened by Jet500.dll (the JET Engine .dll file) for synchronization purposes among instances of itself when they are loaded in different processes. Microsoft WINS and DHCP services use Jet500.dll.

The Jet500.dll file described in the following article in the Microsoft Knowledge Base creates the aforementioned events, semaphores, and mutexs with an Access Control Element (ACE) for administrators:

Q244599 Fixes Required in TCSEC C2 Security Evaluation Configuration for Windows NT 4.0 Service Pack 6a

Specifically, only administrators (DOMAIN_ALIAS_RID_ADMINS) are given GENERIC_ALL access. Others do not have WRITE_DAC or WRITE_OWNER access.

RESOLUTION

The following files are available for download from the Microsoft Download Center or Microsoft's FTP site. Click the file names below to download the appropriate file:

English

x86:
Microsoft Download Center: Q244599i.exe

FTP: Q244599i.exe
Alpha:
Microsoft Download Center: Q244599a.exe

FTP: Q244599a.exe

French

x86:
FTP: Q244599i.exe
Alpha:
FTP: Q244599a.exe

Spanish

x86:
FTP: Q244599i.exe
Alpha:
FTP: Q244599a.exe

For more information about how to download files from the Microsoft Download Center, please visit the Download Center at the following Web address

http://www.microsoft.com/downloads/search.asp

and then click How to use the Microsoft Download Center. The English version of this fix should have the following file attributes or later:


   Date        Time      Size   File name   Platform
   ------------------------------------------------
   10/13/1999  02:28p  458,512  Jet500.dll  x86
   10/13/1999  02:26p  698,640  Jet500.dll  Alpha

STATUS

Microsoft has confirmed this to be a problem in Windows NT 4.0.

Additional query words: c2 security_patch

Keywords : kbbug4.00 kbfix4.00
Version : winnt:4.0
Platform : winnt
Issue type : kbprb