A security advisory posted by German security firm Phion Information Technologies to Internet mailing lists and the company's Web site said that the vulnerability affects the point-to-point tunneling protocol (PPTP) commonly used in the VPN software bundled in Microsoft's Windows 2000 and XP operating systems for servers and PCs.
Companies often use Microsoft's VPN to let employees log into a corporate network remotely via a encrypted channel. Because of the implied security a VPN is supposed to provide, many companies let users connect directly into an internal network--a practice that could make this flaw a valuable one for Internet attackers, warned Marc Maiffret, chief hacking officer for eEye Digital Security.
"It's a gaping hole through the firewall," he said. "Getting into your Web server is bad, but it's not the end of the world. But getting in through your VPN? There's very little security on the inside of the network."
Companies frequently install most security protections on the perimeter of their network, looking outward for potential Internet threats. Any flaw that could let an attacker into the middle of a network could make a company easy prey.
PPTP is the older of two protocols with which users can securely communicate using the VPN software bundled in Windows. The newer option, Layer 2 tunneling protocol or L2TP, can also be used.
Microsoft refuted Phion's claim that the company notified the software giant of the flaw before making information available to the general public. Phion posted information about the vulnerability to several security mailing lists early today.
After about six hours of analysis by Microsoft security response center, Christopher Budd, security program manager for the company, said that the flaw could not be used to run code on a system. If so, that would greatly reduce the severity of the vulnerability: Companies would only have to fear a denial-of-service attack on their VPN systems, not a network intruder.
Budd stressed that Microsoft is continuing to work on the problem and will have more definitive answer soon.
"This is top priority," he said. "We are proceeding with all due speed."
