Microsoft Windows 2000 Telnet Server Allows Local Users to Gain System-Level Privileges and Lets Remote Users Crash the Server
SecurityTracker Alert ID: 1001701|
SecurityTracker URL: http://securitytracker.com/id/1001701
(Links to External Site)
Date: Jun 8 2001
Denial of service via local system, Denial of service via network, Disclosure of system information, Execution of arbitrary code via local system, Root access via local system|
Fix Available: Yes Vendor Confirmed: Yes |
Microsoft has reported seven vulnerabilities with the Windows 2000 Telnet service. The vulnerabilities allow local users to gain system-level privileges on the server, let remote users crash the Telnet server, lets local users terminate Telnet sessions, and may disclose information to remote users.|
Two of the vulnerabilities are due to the improper processing of server-side named pipes, allowing a local user to predict the pipe's name such that when the Telnet server attempts to create that named pipe, it will instead find the pipe to already exist and will simply use the pipe. Code associated with the pipe will then be executed in the Local System context by the Telnet server when it establishes the next Telnet session.
The denial of service vulnerabilities are due to:
1) Failure of the Telnet server to terminate idle sessions, allowing a remote user open a large number of sessions to consume all resources.
2) A handle leak that occurs when Telnet sessions are repeatedly started and then terminated, allowing a remote user to deplete the supply of handles on the server.
3) A specific malformed logon command that causes an access violation in the Telnet service.
4) A system call that can be made by a user with normal user privileges that can terminate a Telnet session.
The information disclosure vulnerability is due to the way in which the server will automatically search all trusted domains for a matching userid if a userid is specified in a particular way. This could make it easier for a remote user to locate Guest accounts that may be exposed via the Telnet server.
A local user can gain system-level privileges on the server. A remote user can crash the Telnet server. A local user can terminate Telnet sessions. A remote user may obtain information about accounts on the server.|
The vendor has released a fix. See the Vendor URL for the vendor's advisory that describes how to obtain the patch.|
Vendor URL: www.microsoft.com/technet/security/bulletin/MS01-031.asp (Links to External Site)
Access control error, Exception handling error, Randomization error, Resource error, State error|
|Underlying OS: Windows (2000)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Subject: Microsoft Security Bulletin MS01-031|
The following is a Security Bulletin from the Microsoft Product Security
Please do not reply to this message, as it was sent from an unattended
-----BEGIN PGP SIGNED MESSAGE-----
Title: Predictable Name Pipes Could Enable Privilege Elevation
Date: 07 June 2001
Software: Windows 2000
Impact: Privilege elevation, denial of service,
Microsoft encourages customers to review the Security Bulletin at:
This bulletin discusses a total of seven vulnerabilities affecting
the Windows 2000 Telnet service. The vulnerabilities fall into three
broad categories: privilege elevation, denial of service and
Two of the vulnerabilities could allow privilege elevation, and have
their roots in flaws related to the way Telnet sessions are created.
When a new Telnet session is established, the service creates a named
pipe, and runs any code associated with it as part of the
initialization process. However, the pipe's name is predictable, and
if Telnet finds an existing pipe with that name, it simply uses it.
An attacker who had the ability to load and run code on the server
could create the pipe and associate a program with it, and the Telnet
service would run the code in Local System context when it stablished
the next Telnet session.
Four of the vulnerabilities could allow denial of service attacks.
None of these vulnerabilities have anything in common with each
- One occurs because it is possible to prevent Telnet from
terminating idle sessions; by creating a sufficient number of such
sessions, an attacker could deny sessions to any other user.
- One occurs because of a handle leak when a Telnet session is
terminated in a certain way. By repeatedly starting sessions and then
terminating them, an attacker could deplete the supply of handles on
the server to point where it could no longer perform useful work.
- One occurs because a logon command containing a particular
malformation causes an access violation in the Telnet service.
- One occurs because a system call can be made using only normal
user privileges, which has the effect of terminating a Telnet
The final vulnerability is an information disclosure vulnerability
that could make it easier for an attacker to find Guest accounts
exposed via the Telnet server. It has exactly the same cause, scope
and effect as a vulnerability affecting FTP and discussed in
Microsoft Security Bulletin MS01-026.
Privilege elevation vulnerabilities:
- Because the attacker would need the ability to load and run code
on the Telnet server, it is likely that these vulnerabilities could
only be exploited by an attacker who had the ability to run code
locally on the Telnet Server.
- Administrative privileges are needed to start the Telnet service,
so the attacker could only exploit the vulnerability if Telnet were
already started on the machine.
Denial of service vulnerabilities:
- It would not be necessary to reboot the server to recover from any
of these vulnerabilities. At worst, the Telnet service would need to
- None of these vulnerabilities could be used to gain additional
privileges on the machine; they are denial of service vulnerabilities
Information disclosure vulnerability:
- The vulnerability could only be exploited if the Guest account on
the local machine was disabled, but the Guest account on a trusted
domain was enabled. By default, the Guest account is disabled.
- A patch is available to fix this vulnerability. Please read the
for information on obtaining this patch.
- Guardent (www.guardent.com) for reporting the two privilege
elevation vulnerabilities and one of the denial of service
- Richard Reiner of Securexpert (www.securexpert.com) for reporting
one of the denial of service vulnerabilities.
- Bindview's Razor Team (razor.bindview.com) for reporting one of
the denial of service vulnerabilities.
- Peter Grundl for reporting one of the denial of service
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF
LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING
LIMITATION MAY NOT APPLY.
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3
-----END PGP SIGNATURE-----
You have received this e-mail bulletin as a result of your registration
to the Microsoft Product Security Notification Service. You may
unsubscribe from this e-mail notification service at any time by sending
an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
The subject line and message body are not used in processing the request,
and can be anything you like.
To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.
For more information on the Microsoft Security Notification Service
please visit http://www.microsoft.com/technet/security/notify.asp. For
security-related information about Microsoft products, please visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.
Go to the Top of This SecurityTracker Archive Page