Description
NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which allows local users to bypass the loader and execute arbitrary programs.
References
- win-execute-permissions-16bit(10132) vdb-entry
- 20020918 Execution Rights Not Checked Correctly For 16-bit Applications mailing-list
- 5740 vdb-entry
- http://www.abtrusion.com/msexe16.asp
- 319458 vendor-advisory