Microsoft Security Bulletin MS02-046: Buffer Overrun in TSAC ActiveX C


Recommended Posts

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------

Title: Buffer Overrun in TSAC ActiveX Control Could Allow

Code Execution (Q327521)

Date: 22 August 2002

Software: Microsoft Terminal Services Advanced Client (TSAC)

ActiveX control, which can be installed on any

Windows system.

Impact: Run code of the attacker's choice

Max Risk: Moderate

Bulletin: MS02-046

Microsoft encourages customers to review the Security Bulletin at:

http://www.microsoft.com/technet/security/...in/MS02-046.asp

- ----------------------------------------------------------------------

Issue:

======

The Terminal Services Advanced Client (TSAC) web control is an

ActiveX control that can be used to run Terminal Services sessions

within Internet Explorer. The downloadable ActiveX control provides

nearly the same functionality as the full Terminal Services Client,

but is designed to deliver this functionality over the Web.

The TSAC control does not come installed as part of any Windows

client system. Instead, clients obtain the control from web

servers that offer terminal services. The configuration process

that enables an IIS server to provide terminal services involves

installing on the server a cabinet file containing the control.

The server then delivers the cabinet file to any client system

that needs it, and the client installs the control via the cabinet

file.

A security vulnerability results because the control contains an

unchecked buffer in the code that processes one of the input

parameters. By calling the control on a client system and

overrunning the buffer, an attacker could gain the ability to

run code in the security context of the currently logged on user.

This would enable the attacker to take any desired action on the

user's system. The attacker could mount an attack by either

hosting a web page that exploits the vulnerability against any

user who visits it, or by sending an HTML mail to another user.

Mitigating Factors:

====================

- The vulnerability could only be exploited if the TSAC control

had been installed on the user's system by an IIS server

hosting the control.

- The vulnerability poses no threat to servers that host it.

While housed on the server, the control is encapsulated in

a cabinet file and cannot be executed.

- The HTML mail-based attack vector could not be exploited on

systems where Outlook 98 or Outlook 2000 were used in

conjunction with the Outlook Email Security Update, or

Outlook Express 6 or Outlook 2002 were used in their

default configurations

Risk Rating:

============

- Internet systems: Low

- Intranet systems: Low

- Client systems: Moderate

Patch Availability:

===================

- A patch is available to fix this vulnerability. Please read the

Security Bulletin at

http://www.microsoft.com/technet/security/...in/ms02-046.asp

for information on obtaining this patch.

Acknowledgment:

===============

- Ollie Whitehouse of @Stake (http://www.atstake.com)

- ---------------------------------------------------------------------

Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.