A vulnerability in the Microsoft Remote Access Connection Manager may allow a remote attacker to execute arbitrary code on a vulnerable system.
Microsoft describes the Routing and Remote Access Service (RRAS) as follows:
RRAS makes it possible for a computer to function as a network router. RRAS also provides the next generation of server functionality for the Remote Access Service (RAS) for Windows. The RRAS server functionality follows and builds upon the Remote Access Service (RAS) that was included in previous operating systems.
The Remote Access Service lets users connect to a remote computer over phone lines, so they can work as if their system were physically connected to the remote network. These services enable remote users to do activities such as send and receive e-mail, fax documents, retrieve files, and print documents on an office printer.
A remote attacker may be able to execute arbitrary code on an affected system. The attacker-supplied code would be execute with Local System privileges. Microsoft states:
Apply a patch
Thanks to Microsoft for reporting this vulnerability. Microsoft, in turn, credits Peter Winter-Smith of NGS Software with reporting this vulnerability to them.
This document was written by Chad R Dougherty.
|Date First Published:||2006-06-13|
|Date Last Updated:||2006-06-14 14:17 UTC|