Denial of Service in Microsoft Windows 2000 Terminal Services

VERSIONS AFFECTED

DESCRIPTION

A vulnerability in Windows 2000 Server Terminal Services can permit a malicious user to force a reboot of the terminal server.

DEMONSTRATION

The discoverer posted the following scenario as proof of concept:

Exploit
-------

1. Open %systemroot%system32msgina.dll for exclusive access (read lock).I used Radsoft's hexview.exe from Rix2K to do so.

2. Open a new connection to the server through RDP/ICA.

3. Click Restart in the warning dialog box ("msgina.dll failed to load") that appears.

Tested on Windows 2000 Server Service Pack 2 (SP2) with Microsoft Internet Exploror (IE) 5.5 and Windows 2000 Server SP3 with IE 5.5.

VENDOR RESPONSE

Microsoft hasn't released a fix or a response. The discoverer posted a workaround for Windows 2000 that suggests removing all permissions on msgina.dll for Power Users, Users, and Everyone.

CREDIT

Discovered by Jonathan Hunter.