A possible flaw in the point-to-point tunneling protocol (PPTP) in both
Windows 2000 and Windows XP could leave corporate intranets vulnerable to
attack, German security firm Phion Information Technologies warned Thursday.
Phion said it had contacted Microsoft about the vulnerability before issuing
its security advisory Thursday morning. Microsoft has not confirmed the
flaw.
PPTP is used to secure virtual private networks (VPNs) by allowing two Internet hosts to communicate over a secure channel utilizing authentication and encryption. Phion claimed that
the PPTP Service shipping with Windows 2000 and Windows XP contains a
remotely exploitable pre-authentication buffer overflow, which could allow a
malicious hacker to overwrite kernel memory with a specially crafted PPTP
packet.
Phion said it has verified a denial-of-service lockup on both Windows 2000
SP3 and Windows XP, and noted that a remote compromise should be possible
through the use of proper shellcode. Additionally, it said clients are
vulnerable, because the service constantly listens to port 1723 on any
interface of the machine, making the vulnerability of special concern to DSL
users utilizing PPTP to connect to their modems.
On the client side, Phion suggested firewalling the PPTP port in the
Internet Connection Firewall for Windows XP. It had no suggestions for
server-side solutions.