A Vulnerability has been reported in Microsoft Windows Telephony, which can be exploited by a local user to gain escalated privileges or by remote malicious user to execute an arbitrary code, depending on the operating system version and configuration.
The telephony server feature is available on Windows 2000 Server and Windows Server 2003 , remote code execution is possible, when these servers are configured as Telephony servers. On Windows Server 2003 the Telephony service is restricted to authenticated user accounts, even when enabled as a telephony server. Anonymous attacks are not possible on Windows 2003 Server. On Windows 2000 Server a remote anonymous user could exploit this vulnerability.
A local elevation of privilege vulnerability is possible on Windows 2000 Server and Windows Server 2003 based systems that have not configured the telephony server. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
On Windows 2000 Professional and on Windows XP, this is a local elevation of privilege vulnerability. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.
By default, the Telephony service is not running on Windows XP and Windows Server 2003. However, the TAPI client will start the Telephony service without user interaction when required. Unless the Telephony service has been set to disabled by an administrator, a non-privileged user account can start this service. Systems that have disabled the Telephony service would not be vulnerable to this issue.
The information provided herein is on "as is" basis, without warranty of any kind.