eEYE on latest RDP DoS (Remote Desktop) Vulnerability

[ecross]

Microsoft has acknowledged that it is working on a patch for a potentially serious security hole in fully patched versions of Windows XP Service Pack 2.

The software maker's confirmation follows public disclosure of the vulnerability by a private security researcher who goes by the moniker "badpack3t."

For a full story, click the following link.
http://www.eweek.com/article2/0,1895,1837726,00.asp

[hongman]

Well it took longer for something like this to happen than what I thought it would. But then again, nothing is perfect!

[Silicon Scream]

Hopefully this isn't a repost...


Microsoft RDP DoS Information

Last week Microsoft released a security alert that warned of a remote Denial of Service (DoS) condition in the Remote Desktop Protocol (RDP). RDP is disabled by default on most Windows versions, with the exception of Media Center. However, many organizations do enable it to aid in remote support.

http://www.microsoft.com/technet/security/advisory/904797.mspx

As of today, there is not a patch available for this vulnerability and complete details are not publicly known. Microsoft and other security experts have recommended that in order to mitigate this vulnerability, users should disable RDP and ensure that TCP Port 3389 is blocked at the firewall level. While this will definitely protect users from the vulnerability, it can significantly impact the business of those organizations that rely on RDP.

About the Vulnerability
eEye Digital Security researchers did not discover this vulnerability, but the researcher who did has consulted with eEye and has provided some additional details about this issue to help us confirm the analysis and assess the risk that it poses. Without going into complete details on this issue, we will explain the already public details and dispel some misconceptions reported by the media.

The first misconception was reported last week. Some known security experts were quoted saying that there is a high likelihood that this vulnerability can be exploited to run arbitrary code on the target systems. This is completely false. The Microsoft analysis on this bug is, in this case, 100% correct and the potential result of a successful exploit is nothing more severe than a DoS. Once details are released, the eEye research team may explain the technical reasons behind why this flaw does not lead to an opportunity to execute arbitrary commands, and offer a look at the exact code behind the vulnerability.

Because there is no opportunity to run arbitrary code, this also removes the possibility for this flaw to be used in a worm attack. As far as attack scenarios go, this vulnerability can be utilized in a Denial of Service (DoS) attack or a blended attack where the attacker requires the ability to force a remote system to reboot. Causing a DoS on a target system would force either an automatic or manual reboot to be required, depending on the target system's configuration.

So what exactly is this vulnerability? This question is difficult to answer without discussing information that is not already public knowledge. A specific driver, RDPWD.SYS, is present on Windows 2000, Windows 2003, and Windows XP. All versions of Windows including Windows XP SP2 are vulnerable, but as mentioned above, only if the RDP service is enabled.

[Silicon Scream]

Will a moderator please move & append this post to the following location to avoid a retread-thread....

http://discussions.virtualdr.com/showthread.php?t=191152

Thank you

[104456]

Threads merged :D

Microsoft recommends that customers follow the published Protect Your PC guidance on enabling a firewall, getting software updates and installing anti-virus software. and disable remote assistance :rolleyes: :D