MS02-029: Unchecked buffer in Remote Access Service phonebook allows code to run
This article was previously published under Q318138 On This PageSYMPTOMS
A privilege-elevation vulnerability exists in the Remote Access Service phonebook. This vulnerability might allow an attacker who successfully exploits the vulnerability to gain complete control over the computer. The attacker can then take any action on the computer such as adding, deleting, or modifying data; creating or deleting user accounts; or adding accounts to the local Administrators group. This vulnerability can be exploited only by an attacker who has credentials to log on to the computer on which the Remote Access service phonebook is located. Best practices suggest that unprivileged users not be permitted to interactively log on to business-critical servers. If you follow this guideline, such servers are not at risk from this vulnerability. CAUSE
This vulnerability is caused by an unchecked buffer in the Remote Access Service phonebook. By creating a specially malformed phonebook entry, an attacker might be able to conduct a buffer-overrun attack against an affected computer.
RESOLUTIONWindows XPTo resolve this problem, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base:322389 (http://support.microsoft.com/kb/322389/) How to Obtain the Latest Windows XP Service Pack
Download InformationThe following file is available for download from the Microsoft Download Center: Download the Q318138 package now (http://www.microsoft.com/downloads/details.aspx?FamilyID=aa83f887-857b-44fe-bb93-5952dba6995b&DisplayLang=en)For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 (http://support.microsoft.com/kb/119591/) How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
Installation OptionsYou must restart your computer after you apply this update. This update supports the following Setup switches:
q318138_wxp_sp1_x86_enu -u -q -z Warning Your computer is vulnerable until you restart it.
File InformationThe English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Date Time Version Size File name and path ------------------------------------------------------------------------ 12-Feb-2002 22:14 5.1.2600.28 218,112 %Windir%\System32\Rasapi32.dll 12-Feb-2002 22:14 5.1.2600.28 630,784 %Windir%\System32\Rasdlg.dll 12-Feb-2002 22:14 5.1.2600.28 13,824 %Windir%\System32\Rassapi.dll Windows XP 64-Bit EditionTo resolve this problem, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base:322389 (http://support.microsoft.com/kb/322389/) How to Obtain the Latest Windows XP Service Pack
Download InformationThe following file is available for download from the Microsoft Download Center:Download the Q318138 package now (http://www.microsoft.com/downloads/details.aspx?FamilyID=8b5e7ae2-6c04-47af-a435-a8909bd83ecf&DisplayLang=en)For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 (http://support.microsoft.com/kb/119591/) How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
Installation OptionsYou must restart your computer after you apply this update. This update supports the following setup switches:
q318138_wxp_sp1_ia64_enu -u -q -z Warning Your computer is vulnerable until you restart it.
File InformationThe English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Date Time Version Size File name and path --------------------------------------------------------------------------- 12-Feb-2002 22:14 5.1.2600.28 698,368 %Windir%\SysWOW64\Rasapi32.dll 12-Feb-2002 22:14 5.1.2600.28 1,480,704 %Windir%\SysWOW64\Rasdlg.dll 12-Feb-2002 22:14 5.1.2600.28 40,448 %Windir%\SysWOW64\Rassapi.dll 12-Feb-2002 22:14 5.1.2600.28 218,112 %Windir%\SysWOW64\Wrasapi32.dll 12-Feb-2002 22:14 5.1.2600.28 630,784 %Windir%\SysWOW64\Wrasdlg.dll 12-Feb-2002 22:14 5.1.2600.28 13,824 %Windir%\SysWOW64\Wrassapi.dll Windows 2000Note Microsoft has identified an issue with the Windows 2000 version of this update that can prevent VPN connections from being made by non-administrators after you apply the update. This article will be updated when an updated patch is available. For additional information about this issue, click the article number below to view the article in the Microsoft Knowledge Base:324908 (http://support.microsoft.com/kb/324908/EN-US/) VPN Connections May Require Administrator Permissions After You Apply MS02-029 (Q318138)
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the
Microsoft Knowledge Base:
260910 (http://support.microsoft.com/kb/260910/EN-US/) How to Obtain the Latest Windows 2000 Service Pack
Download InformationThe following file is available for download from the Microsoft Download Center:Download the Q318138 package now (http://www.microsoft.com/downloads/details.aspx?FamilyID=199429BF-EFB3-456F-B7FE-9734BCABCBCB&displaylang=en)For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 (http://support.microsoft.com/kb/119591/) How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
Installation OptionsYou must restart your computer after you apply this update. For additional information about command-line switches to install or remove this patch, click the article number below to view the article in the Microsoft Knowledge Base:262841 (http://support.microsoft.com/kb/262841/EN-US/) Windows 2000 Hotfix.exe Program Description and Command-Line Switches
For example, the following command line installs the update without any user intervention and then does not force the computer to restart:
q318138_w2k_sp3_x86_en /q /m /z Warning Your computer is vulnerable until you restart it.
File InformationThe English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Date Time Version Size File name and path -------------------------------------------------------------------------- 02-Mar-2002 17:44 5.0.2195.4983 194,320 %Windir%\System32\Rasapi32.dll 02-Mar-2002 17:44 5.0.2195.4983 528,144 %Windir%\System32\Rasdlg.dll 02-Mar-2002 17:44 5.0.2195.4983 58,128 %Windir%\System32\Rasman.dll 02-Mar-2002 17:44 5.0.2195.4983 152,848 %Windir%\System32\Rasmans.dll 02-Mar-2002 17:44 5.0.2195.4983 14,608 %Windir%\System32\Rassapi.dll 02-Mar-2002 17:44 5.0.2195.4983 54,032 %Windir%\System32\Rastapi.dll Windows NT 4.0A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that you determine are at risk of attack. Evaluate the computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to the computer. See the associated Microsoft Security Bulletin (http://www.microsoft.com/technet/security/bulletin/ms02-029.asp) to help determine the degree of risk. This hotfix may receive additional testing. If the computer is sufficiently at risk, we recommend that you apply this hotfix now.To resolve this problem immediately, download the hotfix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site: http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support) Note In special cases, charges that are ordinarily incurred for support calls may be canceled, if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question. Download InformationThe following file, for the given language, is available for download from the Microsoft Download Center:English Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/en-us/q318138i.exe)Arabic Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/ar/araq318138i.exe)Chinese (Hong Kong) Language Version (http://download.microsoft.com/download/winntsp/patchhk/q318138/nt4/tw/chpq318138i.exe)Chinese (Simplified) Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/cn/chsq318138i.exe)Chinese (Traditional) Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/tw/chtq318138i.exe)Czech Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/cs/csy_q318138i.exe)Danish Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/da/dan_q318138i.exe)Dutch Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/nl/nld_q318138i.exe)Finnish Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/fi/fin_q318138i.exe)French Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/fr/fra_q318138i.exe)German Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/de/deuq318138i.exe)Hebrew Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/he/hebq318138i.exe)Hungarian Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/hu/hun_q318138i.exe)Italian Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/it/ita_q318138i.exe)Japanese Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/ja/jpnq318138i.exe)Japanese NEC Language Version (http://download.microsoft.com/download/winntsp/patchnec/q318138/nt4/ja/jpnq318138n.exe)Korean Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/ko/korq318138i.exe)Norwegian Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/no/nor_q318138i.exe)Polish Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/pl/plk_q318138i.exe)Portuguese (Brazilian) Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/pt-br/ptb_q318138i.exe)Russian Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/ru/rus_q318138i.exe)Spanish Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/es/esp_q318138i.exe)Swedish Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/sv/sve_q318138i.exe)Thai Language Version (http://download.microsoft.com/download/winntsp/patch/q318138/nt4/th/thaq318138i.exe)Release Date: June 12, 2002 For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 (http://support.microsoft.com/kb/119591/) How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
Installation OptionsYou must restart your computer after you apply this update. For additional information about the switches that you can use to apply this update, click the article number below to view the article in the Microsoft Knowledge Base:184305 (http://support.microsoft.com/kb/184305/EN-US/) How to Install and Remove Hotfixes with Hotfix.exe
For example, the following command line installs the update without any user intervention and then does not force the computer to restart:
q318138i /q /m /z Warning Your computer is vulnerable until you restart it.
File InformationThe English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Remote Access Service files: Date Time Version Size File name and path -------------------------------------------------------------------------- 07-Mar-2002 14:53 4.0.1381.7140 128,784 %Windir%\System32\Rasapi32.dll 07-Mar-2002 14:53 4.0.1381.7140 153,872 %Windir%\System32\Rascfg.dll 07-Mar-2002 14:53 4.0.1381.7140 348,432 %Windir%\System32\Rasdlg.dll 07-Mar-2002 14:53 4.0.1381.7140 12,560 %Windir%\System32\Rasfil32.dll 07-Mar-2002 14:53 4.0.1381.7140 24,336 %Windir%\System32\Rassapi.dll Windows NT Server 4.0, Terminal Server EditionA supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that you determine are at risk of attack. Evaluate the computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to the computer. See the associated Microsoft Security Bulletin (http://www.microsoft.com/technet/security/bulletin/ms02-029.asp) to help determine the degree of risk. This hotfix may receive additional testing. If the computer is sufficiently at risk, we recommend that you apply this hotfix now.To resolve this problem immediately, download the hotfix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site: http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support) Note In special cases, charges that are ordinarily incurred for support calls may be canceled, if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question. Download InformationThe following file is available for download from the Microsoft Download Center:Download the Q318138 package now (http://download.microsoft.com/download/winntterminal/patch/q318138/nt4/en-us/q318138i.exe)Download the Q318138 package now (http://download.microsoft.com/download/winntterminal/tse/q318138/nt4/en-us/q318138i.exe)For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: 119591 (http://support.microsoft.com/kb/119591/) How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
Installation OptionsYou must restart your computer after you apply this update. For additional information about the switches that you can use to apply this update, click the article number below to view the article in the Microsoft Knowledge Base:184305 (http://support.microsoft.com/kb/184305/EN-US/) How to Install and Remove Hotfixes with Hotfix.exe
For example, the following command line installs the update without any user intervention and then does not force the computer to restart:
q318138i /q /m /z Warning Your computer is vulnerable until you restart it.
File InformationThe English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.Remote Access Service files: Date Time Version Size File name and path --------------------------------------------------------------------------- 12-Mar-2002 19:18 4.0.1381.33533 128,784 %Windir%\System32\Rasapi32.dll 12-Mar-2002 19:18 4.0.1381.33533 154,896 %Windir%\System32\Rascfg.dll 12-Mar-2002 19:18 4.0.1381.33533 348,432 %Windir%\System32\Rasdlg.dll 12-Mar-2002 19:17 4.0.1381.33533 12,560 %Windir%\System32\Rasfil32.dll 12-Mar-2002 19:18 4.0.1381.33533 24,848 %Windir%\System32\Rassapi.dll Date Time Version Size File name and path ---------------------------------------------------------------------- 31-May-2002 17:27 4.1.1.101 131,856 %Windir%\System32\Rasapi32.dll 31-May-2002 18:08 4.1.1.101 158,992 %Windir%\System32\Rascfg.dll 31-May-2002 17:27 4.1.1.101 396,048 %Windir%\System32\Rasdlg.dll 31-May-2002 17:25 4.1.1.101 12,560 %Windir%\System32\Rasfil32.dll 31-May-2002 17:27 4.1.1.101 19,216 %Windir%\System32\Rassapi.dll STATUS
Microsoft has confirmed that this problem may cause a degree of security vulnerability in the Microsoft products that are listed in the "Applies to" section.
This problem was first corrected in Microsoft Windows 2000 Service Pack 3 (SP3) and Microsoft Windows XP Service Pack 1 (SP1). MORE INFORMATION
For more information about this vulnerability, visit the following Microsoft Web site:
http://www.microsoft.com/technet/security/bulletin/ms02-029.mspx (http://www.microsoft.com/technet/security/bulletin/ms02-029.mspx) APPLIES TO
| Article Translations
|
| United States | Change | | | All Microsoft Sites |
Help and Support
Back to the top
|
