{"vuid":"VU#855811","idnumber":"855811","name":"Microsoft Remote Access Service API contains additional buffer overflow vulnerability via phonebook entries","keywords":["Microsoft","Remote Access Service","RAS","RRAS","buffer overflow","rasphone.pbk","phonebook","MS02-029","Q318138","RASAPI32.DLL"],"overview":"The Microsoft Remote Access Service API contains a vulnerability that allows local attackers to execute arbitrary code with system privileges.","clean_desc":"The Microsoft Remote Access Service (RAS) Application Programming Interface (API) allows Windows programs to make dial-up connections to remote servers. There is a buffer overflow in the RAS API that allows an attacker to execute arbitrary code with LocalSystem privileges. To exploit this vulnerability, the attacker must log into an account on the affected system and create a RAS phonebook entry. When any program attempts to use the RAS API to parse the malicious phonebook entry, the entry will cause a buffer overflow and allow the attacker to execute arbitrary code. Once the malicious phonebook entry has been created, the attacker may exploit the vulnerability by initiating a remote connection. However, the attacker may also choose to delay exploitation and allow a different, unsuspecting user to exploit the vulnerability on the attacker's behalf. Since any attempt by the RAS API to parse the phonebook entry may trigger this vulnerability, the victim user need not even attempt to make a connection. The victim might trigger the vulnerability by simply viewing the properties of the crafted phonebook entry. According to Microsoft Security Bulletin MS02-029, the following software is affected by this vulnerability: Microsoft Windows NT 4.0 \nMicrosoft Windows NT 4.0 Terminal Server Edition \nMicrosoft Windows 2000 \nMicrosoft Windows XP \nMicrosoft Routing and Remote Access Server, which can be installed on Windows NT 4.0 Service Pack 6 or NT 4.0 Terminal Server Edition Service Pack 6. This vulnerability is similar to VU#13121, which was first reported on May 19, 1999. For more details, please see http://www.kb.cert.org/vuls/id/13121","impact":"Attackers who are able to create malicious RAS phonebook entries can execute arbitrary code with LocalSystem privileges. In some cases, failed attempts to exploit this vulnerability will cause the affected host to crash.","resolution":"Apply a patch from your vendor Microsoft has released Security Bulletin MS02-029 to address this issue. For more detailed information and upgrade instructions, please see http://www.microsoft.com/technet/security/bulletin/MS02-029.asp","workarounds":"Prevent users from accessing the Remote Access Service For systems that do not require RAS, it may be possible to prevent exploitation of this vulnerability by uninstalling or disabling the Remote Access Service. Prevent users from creating or modifying RAS phonebook entries Attackers must be able to create or modify RAS phonebook entries to exploit this vulnerability. Therefore, it may be possible to utilize access control measures such as NTFS file permissions to prevent users from exploiting this vulnerability.","sysaffected":"","thanks":"This vulnerability was discovered by Next Generation Security Software Ltd.","author":"This document was written by Jeffrey P. Lanza and is based on information provided by Microsoft and Next Generation Security Software Ltd.","public":["http://www.microsoft.com/technet/security/bulletin/MS02-029.asp","http://www.microsoft.com/ntserver/nts/downloads/security/q318138/default.asp","http://www.nextgenss.com/vna/ms-ras.txt","http://www.securityfocus.com/bid/4852","http://www.kb.cert.org/vuls/id/13121"],"cveids":["CVE-2002-0366"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-05-29T16:44:08Z","publicdate":"2002-05-27T00:00:00Z","datefirstpublished":"2002-06-13T21:51:33Z","dateupdated":"2002-06-25T20:33:35Z","revision":38,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"10","cam_internetinfrastructure":"5","cam_population":"10","cam_impact":"20","cam_easeofexploitation":"15","cam_attackeraccessrequired":"10","cam_scorecurrent":"16.875","cam_scorecurrentwidelyknown":"19.6875","cam_scorecurrentwidelyknownexploited":"25.3125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":16.875,"vulnote":null}