Whats wrong with the security descriptor for RASMAN?
Like other services, RASMAN’s security descriptor (specifically, the DACL in the security descriptor) should only allow administrators to manage it. However, there is an erroneous ACE in the DACL for RASMAN, which allows any user to manage RASMAN via the Service Control Manager. A malicious user could exploit this situation by changing the ImagePath parameter for RASMAN – this parameter specifies the executable code for the service. Changing this parameter would cause different code to execute in place of RASMAN. Significantly, the new code would run in System context, which would allow the code to take virtually any action on the computer.
