Microsoft Remote Access Connection Manager service vulnerable to buffer overflow

Overview

A vulnerability in the Microsoft Remote Access Connection Manager may allow a remote attacker to execute arbitrary code on a vulnerable system.

Description

Microsoft describes the Routing and Remote Access Service (RRAS) as follows:

RRAS makes it possible for a computer to function as a network router. RRAS also provides the next generation of server functionality for the Remote Access Service (RAS) for Windows. The RRAS server functionality follows and builds upon the Remote Access Service (RAS) that was included in previous operating systems.

The Remote Access Service lets users connect to a remote computer over phone lines, so they can work as if their system were physically connected to the remote network. These services enable remote users to do activities such as send and receive e-mail, fax documents, retrieve files, and print documents on an office printer.
The Remote Access Service is a native service in Windows 2000, Windows XP and Windows Server 2003.

A buffer overflow vulnerability exists in a Remote Procedure Call (RPC) interface provided by the Remote Access Connection Manager (RASMAN) supplied with Microsoft Windows. Exploitation of this vulnerability can result in registry corruption and subsequent stack memory corruption on the affected system.

---

Impact

A remote attacker may be able to execute arbitrary code on an affected system. The attacker-supplied code would be execute with Local System privileges. Microsoft states:

On Windows 2000 Service Pack 4 and Windows XP Service Pack 1, any anonymous user who could deliver a specially crafted message to the affected system could try to exploit this vulnerability. In order to exploit the vulnerability on Windows XP Service Pack 2 and Windows Server 2003, an attacker must have valid login credentials to a target system.

---

Solution

Apply a patch

Microsoft has published patches for this issue in Microsoft Security Bulletin MS06-025.

---

Workarounds

In addition to the patches, Microsoft has also published a number of workarounds for this issue in Microsoft Security Bulletin MS06-025. Users, particularly those who are unable to apply the patch, are encouraged to implement these workarounds.

---

Vendor Information

814644

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: June 13, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Microsoft has published Microsoft Security Bulletin MS06-025 in response to this issue. Users are encouraged to review this bulletin and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23814644 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/ms06-025.mspx&gt;
• <http://www.ngssoftware.com/advisories/rasman.txt&gt;

Acknowledgements

Thanks to Microsoft for reporting this vulnerability. Microsoft, in turn, credits Peter Winter-Smith of NGS Software with reporting this vulnerability to them.

This document was written by Chad R Dougherty.

Other Information

CVE IDs:	CVE-2006-2371
Severity Metric:	20.31 Date Public: