NGSSoftware Insight Security Research Advisory
Name: Buffer Overflow in Microsoft Rasapi32.dll
Systems Affected: WinNT, Win2K, XP, Microsoft Routing And Remote Access
Server ("Steelhead")
Severity: High
Category: Buffer Overrun / Privilege Escalation
Vendor URL: http://www.microsoft.com/
Author: Mark Litchfield ([email protected])
Date: 13th June 2002
Advisory number: #NISR13062002
Vendor Notification Details
The VNA for this issue can be found at
http://www.nextgenss.com/vna/ms-ras.txt
The elapsed time between notification and fix was seven months.
Description
Rasapi32.dll contains an unchecked buffer, essentially allowing a local user
to overflow any executablethat has a GUI help feature or connects to the
internet.
This can be used to obtain system privileges on a machine that an attacker
can interactively
log on to, or to "Trojan" a machine on which they can edit the phone book
properties.
Details
Rasapi32.dll ships with all recent Microsoft operating systems, being
described
as the "Dial-Up Networking Dynamic Linked Library and a Remote Access API".
The overflow occurs when the code that parses RAS phonebook entries runs;
this can occur when a user logs on interactively, or when a user views the
dial-up
connection properties. Specifically, an overly-long 'script name' (stored in
the Rasphone.pbk file)
will cause the overflow.
A possible (interactive) exploit scenario would be:
An interesting aspect of this overflow is that it exploits the logon dialog
that occurs after the Secure Attention Sequence (Crtl+Alt+Del), which is
designed to prevent other
programs or processes from intervening during authentication (that is, to
prevent trojan-horse programs
from being executed during the authentication process), effectively turning
a defence mechanism into a
security problem.
Another interesting point is that on our Windows 2000 test platform the
overflow string was Unicode, but on our Windows XP and Windows NT test
platforms the overflow
string was ASCII.
The overflow can also be used to "poison" a machine such that the next time
a dial-up connection is used, some exploit code is run. Interestingly, it is
possible to exploit the
problem using most windows applications, via the "Internet Options" menu
item accessible via the help
menu. For example, to cause the overrun to occur in Solitaire (SOL.exe),
open Solitaire, select help,
contents, options, internet options and finally connections.
Fix Information
NGSSoftware alerted Microsoft to these problems in November of last year.
Microsoft's advisory on this
issue can be found at
http://www.microsoft.com/technet/security/bulletin/MS02-029.asp
Microsoft's advisory contains patch download information, as well as a
discussion of the issue.
A check for this issue has been added to Typhon II, of which more
information is available from the
NGSSoftware website, http://www.ngssoftware.com.
Further Information
For further information about the scope and effects of buffer overflows,
please see
http://www.ngssoftware.com/papers/ntbufferoverflow.html
http://www.ngssoftware.com/papers/bufferoverflowpaper.rtf
http://www.ngssoftware.com/papers/unicodebo.pdf
http://www.ngssoftware.com/papers/non-stack-bo-windows.pdf