-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2002.459 -- Microsoft Security Bulletin MS02-046
     Buffer Overrun in TSAC ActiveX Control Could Allow Code Execution
                                 (Q327521)
                              23 August 2002

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Terminal Services Advanced Client (TSAC)
Vendor:                 Microsoft
Operating System:       Windows NT Server 4.0
                        Windows NT Server 4.0 Enterprise Edition
                        Windows NT Server 4.0 Terminal Server Edition
                        Windows 2000 Professional
                        Windows 2000 Server
                        Windows 2000 Advanced Server
                        Windows 2000 Datacenter Server
Impact:                 Execute Arbitrary Code/Commands
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------------
Title:      Buffer Overrun in TSAC ActiveX Control Could Allow 
            Code Execution (Q327521)
Date:       22 August 2002
Software:   Microsoft Terminal Services Advanced Client (TSAC)
            ActiveX control, which can be installed on any 
            Windows system. 
Impact:     Run code of the attacker's choice 
Max Risk:   Moderate
Bulletin:   MS02-046

Microsoft encourages customers to review the Security Bulletin at: 
http://www.microsoft.com/technet/security/bulletin/MS02-046.asp
- - ----------------------------------------------------------------------

Issue:
======
The Terminal Services Advanced Client (TSAC) web control is an
ActiveX control that can be used to run Terminal Services sessions
within Internet Explorer. The downloadable ActiveX control provides
nearly the same functionality as the full Terminal Services Client,
but is designed to deliver this functionality over the Web.

The TSAC control does not come installed as part of any Windows
client system. Instead, clients obtain the control from web
servers that offer terminal services. The configuration process
that enables an IIS server to provide terminal services involves
installing on the server a cabinet file containing the control.
The server then delivers the cabinet file to any client system
that needs it, and the client installs the control via the cabinet
file.

A security vulnerability results because the control contains an
unchecked buffer in the code that processes one of the input
parameters. By calling the control on a client system and
overrunning the buffer, an attacker could gain the ability to
run code in the security context of the currently logged on user.
This would enable the attacker to take any desired action on the
user's system. The attacker could mount an attack by either
hosting a web page that exploits the vulnerability against any
user who visits it, or by sending an HTML mail to another user. 


Mitigating Factors:
====================
 - The vulnerability could only be exploited if the TSAC control
   had been installed on the user's system by an IIS server
   hosting the control. 

 - The vulnerability poses no threat to servers that host it. 
   While housed on the server, the control is encapsulated in 
   a cabinet file and cannot be executed. 

 - The HTML mail-based attack vector could not be exploited on
   systems where Outlook 98 or Outlook 2000 were used in 
   conjunction with the Outlook Email Security Update, or 
   Outlook Express 6 or Outlook 2002 were used in their 
   default configurations 

Risk Rating:
============
 - Internet systems: Low
 - Intranet systems: Low
 - Client systems: Moderate

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletin at
   http://www.microsoft.com/technet/security/bulletin/ms02-046.asp
   for information on obtaining this patch.

Acknowledgment:
===============
 - Ollie Whitehouse of @Stake (http://www.atstake.com)

- - ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS 
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE 
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR 
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPWVnzY0ZSRQxA/UrAQEDXwf+Lryd4K8qCiDoyFnRZdV6C9Id0weqcsV+
wmEfEKYND6QSzvkowgkK1tJHwecros/01/K2dkai7PW6e2LZiFBlpBtnZKRu+n/+
xFgQSJfgzWwk7LcRzQB53+Dllcq9i7eN7onyRWwvRwjfIJniqDjj3kffgwtLHsji
rzrw3AGE1knBiJPACoI4q4Qych22qERTqU1W4B1Y21PPTaE7u4PhzLOya5y32jqh
puA8JgOMaa8bUVwchHdVhIdZ3D7HY9rMG4y4JH1gaE/0AQiO8n6w2FG0D5/G6WKL
a0ZiGCIzDqzD2I8FcY6bDw9pZd06WOU2EkfWKqoK24yWXov4/aEihQ==
=GMwu
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBPWYz5Sh9+71yA2DNAQG4WAP/epGeN+zPylY5oXZjPGqpZjG6Wzn1EsQr
+aazgvzatuFxU+s4wjs0rr+4CxtDYgTs4DdsbGftwYoq44GfOJ6KhIBUqdFYnfLc
YKQ8L/v6GQ3U8GDiHi7nsR9RNf5Lxi2yqjGGG+YPgDJBbbTcHkFrJr+rzOv5OfIW
GKi/jrF9Sfw=
=5/AY
-----END PGP SIGNATURE-----