Internet Protocol Helper API is Exploited on Windows Vista

Phion published a proof of concept paper which shows how the Internet Protocol Helper API of Windows Vista can be exploited to trigger a stack buffer overflow which leads to the execution of random code.

Even though the Internet Protocol Helper API is also used by Windows NT and Windows XP, only Vista is affected specifically the Enterprise and Ultimate versions.

In an excerpt:

The Phion bulletin explicitly says that Windows XP, which also utilizes this API library, is not affected by this problem. The library in question has been in existence since Windows NT 4.0 Service Pack 4, and has been a regular component of successive versions since Windows 98.

Windows Vista was the first client operating system from Microsoft to support IPv6 protocol as a standard feature, although IPv6 remains an option for XP and older clients. It's that distinction which leads to the Vista-specificity of this issue. The IP Helper API gives developers more direct access to the functions necessary for a Windows computer to utilize IP. So naturally, one of the functions included enables a program to establish an IP route for the local computer, and the original form of that function was called CreateIpForwardEntry.

Since the introduction of IPv6 as standard issue, the library had to offer an alternative way to phrase the forward route entry, though it had to also leave the earlier version of the function for backward compatibility. Thus the creation of CreateIpForwardEntry2, an API function that is only workable in Vista. An XP or older client would never make use of it, presumably even with IPv6 intentionally installed.

Thus the situation where the route add command, as Phion illustrated, can be gamed in such a way that it triggers a buffer overflow in Vista but not in XP. Evidently the command utilizes the older API function in XP, and the newer one in Vista.

The patch has not yet been made available by Microsoft despite over a month has gone since Phion first reported it on Oct. 22. Because of this, Phion has released their own hotfix which replaces Vista library.

I don't think I would want to install a hotfix for a critical item from a third party unauthorized vendor. I would prefer to wait for Microsoft updates on this.

Leave a Comment