Windows RRAS Service Remote Code Execution Vulnerability

Added: 06/06/2018
BID: 102055

Background

Routing Remote Access Service (RRAS) is a Microsoft API that can be used to create client applications. These applications display RAS common dialog boxes, manage remote access connections and devices, and manipulate phone-book entries. These APIs make it possible to create applications to administer the routing capabilities of the operating system. Additionally, developers can use the Routing Protocol APIs to implement routing protocols.

Problem

Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow a remote code execution vulnerability due to the way the Routing and Remote Access service handles requests, aka “Windows RRAS Service Remote Code Execution Vulnerability”.

Resolution

Consider to disable the RRAS service if you are still using Windows Server 2003 or Apply a patch when Microsoft has issued to fix it.

References

[https://www.exploit-db.com/exploits/44616/
](<https://www.exploit-db.com/exploits/44616/ <br>
>)
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11885
](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11885 <br>
>)
[http://www.securityfocus.com/bid/102055
](<http://www.securityfocus.com/bid/102055 <br>
>)
[http://www.securitytracker.com/id/1039987
](<http://www.securitytracker.com/id/1039987 <br>
>)

Limitations

This exploit has been tested on Windows Server 2003 SP2 (ES).

It is effective only when the RRAS service is enabled.

Platforms

Windows Server 2003