Microsoft Windows 2000 Terminal Server runas.exe denial of service ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Microsoft Windows 2000. The affected element is an unknown function of the file runas.exe of the component Terminal Server. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2001-1518. Local access is required to approach this attack. Moreover, an exploit is present. The actual existence of this vulnerability is currently in question. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Microsoft Windows 2000 (Operating System). It has been rated as problematic. This issue affects an unknown functionality of the file runas.exe of the component Terminal Server. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

RunAs (runas.exe) in Windows 2000 only creates one session instance at a time, which allows local users to cause a denial of service (RunAs hang) by creating a named pipe session with the authentication server without any request for service. NOTE: the vendor disputes this vulnerability, however the vendor also presents a scenario in which other users could be affected if running on a Terminal Server. Therefore this is a vulnerability.

The issue has been introduced in 02/17/2000. The weakness was disclosed 12/31/2001 as not defined posting (Bugtraq). The advisory is shared at online.securityfocus.com. The identification of this vulnerability is CVE-2001-1518 since 07/14/2005. The exploitation is known to be easy. An attack has to be approached locally. The successful exploitation needs a simple authentication. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 683 days. During that time the estimated underground price was around $0-$5k. The real existence of this vulnerability is still doubted at the moment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (7533), Exploit-DB (21099) and SecurityFocus (BID 3291†). The entries VDB-17838, VDB-17836 and VDB-17834 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 2000

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion