BID:18325

Microsoft Windows Routing and Remote Access Remote Code Execution Vulnerability

CVE-2006-2370 |

Info

Microsoft Windows Routing and Remote Access Remote Code Execution Vulnerability

Bugtraq ID:	18325
Class:	Boundary Condition Error
CVE:	CVE-2006-2370
Remote:	Yes
Local:	No
Published:	Jun 13 2006 12:00AM
Updated:	Jun 29 2006 06:09PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP Gold 0 Microsoft Windows XP 0 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows Routing and Remote Access Remote Code Execution Vulnerability

Microsoft Windows Routing and Remote Access is prone to a memory-corruption vulnerability. This issue is due to the software's failure to properly bounds-check user-supplied network data before copying it to an insufficiently sized memory buffer.

This issue allows remote attackers to execute arbitrary machine code on affected computers with SYSTEM-level privileges. This facilitates the complete compromise of affected computers.

Exploiting this issue on Microsoft Windows XP SP2 or Windows Server 2003 requires valid login credentials. Anonymous attacks are possible with Windows 2000 and Windows XP versions prior to SP2.

Exploit / POC

Microsoft Windows Routing and Remote Access Remote Code Execution Vulnerability

A proof-of-concept exploit is available to members of the Immunity Partner's Program. No publicly available exploit is known to exist at this time.

The exploit is available from the following location:

https://www.immunityinc.com/downloads/immpartners/ms06_025b.tar

It is currently unknown if this exploit targets the vulnerability reported in this BID or the one described in BID 18358, since they were both addressed in Microsoft Security Advisory MS06-025.

Two Metasploit framework exploit modules are available:

rras_ms06_025.pm
rras_ms06_025_rasman.pm

Solution / Fix

Microsoft Windows Routing and Remote Access Remote Code Execution Vulnerability

Solution:
Microsoft has released an advisory along with fixes to address this issue. Please see the referenced advisory for more information.

Microsoft has updated security bulletin MS06-025 to re-release fixes to address issues affecting customers using a terminal window or dial-up scripting with dial-up connections. The vendor has also resolved issues involving scripts to change device configuration parameters using the following commands:

- set port parity
- set port databits
- set port stopbits

These issues arose for users after installing the original fixes released as part of MS06-025. More information is available in Microsoft's Knowledge Base Article 911280. Please see the references for details.

Microsoft Windows Server 2003 Datacenter Edition SP1