VULHUB ™

Remote Access Service (RAS) is a service included in Microsoft Windows 2000, NT 4.0 and XP to allow users to connect to a corporate intranet or the Internet from a remote computer. The RAS service included with several versions of Microsoft Windows is vulnerable to a buffer overflow issue. This may be exploited by a local attacker by creating a malicious phonebook entry. It is possible to gain elevated privileges, or create a denial of service condition. ** It has been reported that the Microsoft supplied patch to correct this issue may cause problems with PPTP RAS connections on Windows 2000 Professional. This problem has not been confirmed by SecurityFocus at this time. Microsoft also has not yet publicly acknowledged that this problem occurs. ** Microsoft has now released an updated patch version that correctly handles VPN connections.

Remote Access Service (RAS) is a service included in Microsoft Windows 2000, NT 4.0 and XP to allow users to connect to a corporate intranet or the Internet from a remote computer. The RAS service included with several versions of Microsoft Windows is vulnerable to a buffer overflow issue. This may be exploited by a local attacker by creating a malicious phonebook entry. It is possible to gain elevated privileges, or create a denial of service condition. ** It has been reported that the Microsoft supplied patch to correct this issue may cause problems with PPTP RAS connections on Windows 2000 Professional. This problem has not been confirmed by SecurityFocus at this time. Microsoft also has not yet publicly acknowledged that this problem occurs. ** Microsoft has now released an updated patch version that correctly handles VPN connections.