Alert: Microsoft Security Bulletin - MS02-046
From: Russ (Russ.Cooper@RC.ON.CA)Date: 08/23/02
- Previous message: Russ: "Alert: Microsoft Security Bulletin - MS02-045"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 22 Aug 2002 20:10:59 -0400 From: Russ <Russ.Cooper@RC.ON.CA> To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
http://www.microsoft.com/technet/security/bulletin/MS02-046.asp
Buffer Overrun in TSAC ActiveX Control Could Allow Code Execution (Q327521)
Originally posted: August 22, 2002
Summary
Who should read this bulletin: Customers using Microsoft® Windows® systems
Impact of vulnerability: Run code of the attacker's choice
Maximum Severity Rating: Moderate
Recommendation:
- Administrators of web sites hosting the TSAC ActiveX control should install the new control immediately.
- Users should apply the latest cumulative patch for Internet Explorer (at this writing, the latest patch is provided in Microsoft Security Bulletin Microsoft Security Bulletin MS02-047).
Affected Software:
- Microsoft Terminal Services Advanced Client (TSAC) ActiveX control, which can be installed on any Windows system.
Technical description:
The Terminal Services Advanced Client (TSAC) web control is an ActiveX control that can be used to run Terminal Services sessions within Internet Explorer. The downloadable ActiveX control provides nearly the same functionality as the full Terminal Services Client, but is designed to deliver this functionality over the Web.
The TSAC control does not come installed as part of any Windows client system. Instead, clients obtain the control from web servers that offer terminal services. The configuration process that enables an IIS server to provide terminal services involves installing on the server a cabinet file containing the control. The server then delivers the cabinet file to any client system that needs it, and the client installs the control via the cabinet file.
A security vulnerability results because the control contains an unchecked buffer in the code that processes one of the input parameters. By calling the control on a client system and overrunning the buffer, an attacker could gain the ability to run code in the security context of the currently logged on user. This would enable the attacker to take any desired action on the user's system. The attacker could mount an attack by either hosting a web page that exploits the vulnerability against any user who visits it, or by sending an HTML mail to another user.
Mitigating factors:
- The vulnerability could only be exploited if the TSAC control had been installed on the user's system by an IIS server hosting the control.
- The vulnerability poses no threat to servers that host it. While housed on the server, the control is encapsulated in a cabinet file and cannot be executed.
- The HTML mail-based attack vector could not be exploited on systems where Outlook 98 or Outlook 2000 were used in conjunction with the Outlook Email Security Update, or Outlook Express 6 or Outlook 2002 were used in their default configurations
Vulnerability identifier: CAN-2002-0726
This email is sent to NTBugtraq automatically as a service to my subscribers. Since its programmatically created, and since its been a long time since anyone paid actual money for my programming skills, it may or may not look that good...;-]
I can only hope that the information it does contain can be read well enough to serve its purpose.
Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor
- Previous message: Russ: "Alert: Microsoft Security Bulletin - MS02-045"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
