Title: Buffer Overrun in TSAC ActiveX Control Could Allow
Code Execution (Q327521)
Date: 22 August 2002
Software: Microsoft Terminal Services Advanced Client (TSAC)
ActiveX control, which can be installed on any
Windows system.
Impact: Run code of the attacker's choice
Max Risk: Moderate
Bulletin: MS02-046

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS02-046.asp

Issue:

The Terminal Services Advanced Client (TSAC) web control is an
ActiveX control that can be used to run Terminal Services sessions
within Internet Explorer. The downloadable ActiveX control provides
nearly the same functionality as the full Terminal Services Client,
but is designed to deliver this functionality over the Web.

The TSAC control does not come installed as part of any Windows
client system. Instead, clients obtain the control from web
servers that offer terminal services. The configuration process
that enables an IIS server to provide terminal services involves
installing on the server a cabinet file containing the control.
The server then delivers the cabinet file to any client system
that needs it, and the client installs the control via the cabinet
file.

A security vulnerability results because the control contains an
unchecked buffer in the code that processes one of the input
parameters. By calling the control on a client system and
overrunning the buffer, an attacker could gain the ability to
run code in the security context of the currently logged on user.
This would enable the attacker to take any desired action on the
user's system. The attacker could mount an attack by either
hosting a web page that exploits the vulnerability against any
user who visits it, or by sending an HTML mail to another user.

Mitigating Factors:

• The vulnerability could only be exploited if the TSAC control
  had been installed on the user's system by an IIS server
  hosting the control.

• The vulnerability poses no threat to servers that host it.
  While housed on the server, the control is encapsulated in
  a cabinet file and cannot be executed.

• The HTML mail-based attack vector could not be exploited on
  systems where Outlook 98 or Outlook 2000 were used in
  conjunction with the Outlook Email Security Update, or
  Outlook Express 6 or Outlook 2002 were used in their
  default configurations

Risk Rating:

• Internet systems: Low
• Intranet systems: Low
• Client systems: Moderate

Patch Availability:

• A patch is available to fix this vulnerability. Please read the
  Security Bulletin at
  http://www.microsoft.com/technet/security/bulletin/ms02-046.asp
  for information on obtaining this patch.

Acknowledgment:

• Ollie Whitehouse of @Stake (http://www.atstake.com)

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.