PT-2002-1429 · Microsoft · Windows 2000+4

Publicado 2002-07-03 · Atualizado 2019-04-30 · CVE-2002-0366

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows NT versions 4.0 Windows 2000 Windows XP Routing and Remote Access Server (RRAS)

Description A buffer overflow issue exists in the Remote Access Service (RAS) phonebook, allowing local users to execute arbitrary code. This is achieved by modifying the rasphone.pbk file to use a long dial-up entry.

Recommendations For Windows NT 4.0, consider restricting access to the rasphone.pbk file to prevent unauthorized modifications. For Windows 2000, avoid using long dial-up entries in the RAS phonebook until a fix is available. For Windows XP, restrict access to the RAS phonebook to minimize the risk of exploitation. For Routing and Remote Access Server (RRAS), consider disabling the RAS phonebook feature as a temporary workaround until a patch is available.

Correção

Identificadores relacionados

CVE-2002-0366

Produtos afetados

Remote Access Service

Routing/Remote Access Server

Windows 2000

Windows Nt

Windows Xp

Referências · 8

• http://online.securityfocus.com/archive/1/276776 · Nota
• http://online.securityfocus.com/archive/1/278145 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A61 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0366 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A63 · Nota
• http://nextgenss.com/vna/ms-ras.txt · Aviso do Fabricante
• http://securityfocus.com/bid/4852 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-029 · Aviso do Fabricante