[THIN] Security Alert:* BUFFER OVERRUN IN MICROSOFT TSAC
- From: "Jim Kenzig http://thethin.net" <jimkenz@xxxxxxxxxxxxxx>
- To: <thin@xxxxxxxxxxxxx>, <thinnews@xxxxxxxxxxxxx>
- Date: Mon, 26 Aug 2002 23:09:50 -0400
From Window .Net magazine security newsletter
* BUFFER OVERRUN IN MICROSOFT TSAC
Ollie Whitehouse of @stake discovered a buffer-overrun condition in
Microsoft Terminal Services Advanced Client (TSAC) ActiveX control
that can let an attacker execute arbitrary code remotely on the
vulnerable system. This vulnerability results from an unchecked buffer
in the control's code that processes one of the input parameters. By
calling the control on a client system and overrunning the buffer, an
attacker can run code under the currently logged-on user's security
context. The attacker can mount an attack by either hosting a Web page
that exploits the vulnerability against any user who visits the Web
page or by sending HTML mail to another user. Microsoft has released
Security Bulletin MS02-046 (Buffer Overrun in TSAC ActiveX Control
Could Allow Code Execution) to address these vulnerabilities and
recommends that affected users download and apply the appropriate
patch.
http://www.secadministrator.com/articles/index.cfm?articleid=26409
Technical description:
The Terminal Services Advanced Client (TSAC) web control is an ActiveX
control that can be used to run Terminal Services sessions within Internet
Explorer. The downloadable ActiveX control provides nearly the same
functionality as the full Terminal Services Client, but is designed to
deliver this functionality over the Web.
The TSAC control does not come installed as part of any Windows client
system. Instead, clients obtain the control from web servers that offer
terminal services. The configuration process that enables an IIS server to
provide terminal services involves installing on the server a cabinet file
containing the control. The server then delivers the cabinet file to any
client system that needs it, and the client installs the control via the
cabinet file.
A security vulnerability results because the control contains an unchecked
buffer in the code that processes one of the input parameters. By calling
the control on a client system and overrunning the buffer, an attacker could
gain the ability to run code in the security context of the currently logged
on user. This would enable the attacker to take any desired action on the
user?s system. The attacker could mount an attack by either hosting a web
page that exploits the vulnerability against any user who visits it, or by
sending an HTML mail to another user.
Mitigating factors:
The vulnerability could only be exploited if the TSAC control had been
installed on the user?s system by an IIS server hosting the control.
The vulnerability poses no threat to servers that host it. While housed on
the server, the control is encapsulated in a cabinet file and cannot be
executed.
The HTML mail-based attack vector could not be exploited on systems where
Outlook 98 or Outlook 2000 were used in conjunction with the Outlook Email
Security Update, or Outlook Express 6 or Outlook 2002 were used in their
default configurations
Patch is at:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS02-046.asp
(link will wrap copy it all)
===================================
This weeks Sponsor:
ThinPrint
- High resolution, DRIVER FREE PRINTING with no loss of quality in color.
- Removes print spooling and rendering tasks from your terminal server.
http://www.thinprint.com
===================================
For Archives, to Unsubscribe, Subscribe or
set Digest or Vacation mode use the below link.
http://thethin.net/citrixlist.cfm
Other related posts:
- » [THIN] Security Alert:* BUFFER OVERRUN IN MICROSOFT TSAC
