Vulnerability in Remote Desktop Protocol (RDP)

Microsoft is investigating new public reports of a vulnerability in Remote Desktop Services. We have not been made aware of attacks that try to use the reported vulnerability or of customer impact at this time, but we are aggressively investigating the public reports.

Our initial investigation has revealed that a denial of service vulnerability exists that could allow an attacker to send a specially crafted Remote Desktop Protocol (RDP) request to an affected system. Our investigation has determined that this is limited to a denial of service, and therefore an attacker could not use this vulnerability to take complete control of a system. Services that utilize the Remote Desktop Protocol are not enabled by default, however if a service were enabled, an attacker could cause this system to restart.

About the Vulnerability
eEye Digital Security researchers did not discover this vulnerability, but the researcher who did has consulted with eEye and has provided some additional details about this issue to help us confirm the analysis and assess the risk that it poses. Without going into complete details on this issue, we will explain the already public details and dispel some misconceptions reported by the media.

The first misconception was reported last week. Some known security experts were quoted saying that there is a high likelihood that this vulnerability can be exploited to run arbitrary code on the target systems. This is completely false. The Microsoft analysis on this bug is, in this case, 100% correct and the potential result of a successful exploit is nothing more severe than a DoS. Once details are released, the eEye research team may explain the technical reasons behind why this flaw does not lead to an opportunity to execute arbitrary commands, and offer a look at the exact code behind the vulnerability.

Because there is no opportunity to run arbitrary code, this also removes the possibility for this flaw to be used in a worm attack. As far as attack scenarios go, this vulnerability can be utilized in a Denial of Service (DoS) attack or a blended attack where the attacker requires the ability to force a remote system to reboot. Causing a DoS on a target system would force either an automatic or manual reboot to be required, depending on the target system's configuration.

So what exactly is this vulnerability? This question is difficult to answer without discussing information that is not already public knowledge. A specific driver, RDPWD.SYS, is present on Windows 2000, Windows 2003, and Windows XP. All versions of Windows including Windows XP SP2 are vulnerable, but as mentioned above, only if the RDP service is enabled.

Oricum, filtrarea ramane sfanta pe RDP. Ma oftic cand nu am acces direct de prin diverse locuri publice / mobile, dar e mai sigur asa ... Deocamdata. 

<{POST_SNAPBACK}>