(MS12-020) Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)

Publish date: March 05, 2013

Severity: CRITICAL

CVE Identifier: CVE-2012-0002,CVE-2012-0152

Advisory Date: MAR 20, 2012

DESCRIPTION

This security update addresses two privately reported vulnerabilities in the Remote Desktop Protocol, which may result to code execution if an attacker sends specially crafted rdp packets to an affected system. The Remote Desktop Protocol (RDP) is not defaultly enabled on Windows Operating system, thus those systems with unabled RDP are not affected.

There are reports indicating the emergence of proof of concept code in the wild. Trend Micro is able to provide solutions against PoC code related to this vulnerability.

Below are details of the two vulnerabilities:

Microsoft Bulletin ID	Vulnerability ID
MS12-020	Remote Desktop Protocol Vulnerability (CVE-2012-0002)
MS12-020	Terminal Server Denial of Service Vulnerability (CVE-2012-0152)

TREND MICRO PROTECTION INFORMATION

Trend Micro Deep Security shields networks through Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities. Please refer to the filter number and filter name when applying appropriate DPI and/or IDF rules.

SOLUTION

PATCH: http://technet.microsoft.com/en-us/security/bulletin/ms12-020

AFFECTED SOFTWARE AND VERSION

Windows XP Service Pack 3 (KB2621440)
Windows XP Professional x64 Edition Service Pack 2 (KB2621440)
Windows Server 2003 Service Pack 2 (KB2621440)
Windows Server 2003 x64 Edition Service Pack 2 (KB2621440)
Windows Server 2003 with SP2 for Itanium-based Systems (KB2621440)
Windows Vista Service Pack 2 (KB2621440)
Windows Vista x64 Edition Service Pack 2 (KB2621440)
Windows Server 2008 for 32-bit Systems Service Pack 2 (KB2621440)
Windows Server 2008 for x64-based Systems Service Pack 2 (KB2621440)
Windows Server 2008 for Itanium-based Systems Service Pack 2 (KB2621440)
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 (KB2621440)
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 (KB2667402)
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 (KB2621440)
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 (KB2667402)
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1 (KB2621440)
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1 (KB2667402)
Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (KB2621440)
Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (KB2667402)

OTHER INFORMATION

Know Your Enemies, Part 1 (Video)

Know Your Enemies, Part 2 (Video)

CTO Insights: Raimund Genes Talks About the Security Predictions for 2012

Related Blog Entries

Related Vulnerability

Related Malware

DDOS_DUCAU.A

Related Web Attack

The Importance of MS12-020: Remote Desktop Sessions at Risk

Featured Stories

$The Mirage of AI Programming: Hallucinations and Code Integrity$
The Mirage of AI Programming: Hallucinations and Code Integrity
The adoption of large language models (LLMs) and Generative Pre-trained Transformers (GPTs), such as ChatGPT, by leading firms like Microsoft, Nuance, Mix and Google CCAI Insights, drives the industry towards a series of transformative changes. As the use of these new technologies becomes prevalent, it is important to understand their key behavior, advantages, and the risks they present.
Read more
$Open Ran Attack of xApps$
Open RAN: Attack of the xApps
This article discusses two O-RAN vulnerabilities that attackers can exploit. One vulnerability stems from insufficient access control, and the other arises from faulty message handling
Read more
$A Closer Exploration of Residential Proxies and CAPTCHA-Breaking Services$
A Closer Exploration of Residential Proxies and CAPTCHA-Breaking Services
This article, the final part of a two-part series, focuses on the details of our technical findings and analyses of select residential proxies and CAPTCHA-solving services.
Read more
$How Residential Proxies and CAPTCHA-Solving Services Become Agents of Abuse$
How Residential Proxies and CAPTCHA-Solving Services Become Agents of Abuse
This article, the first of a two-part series, provides insights on how abusers and cybercriminals use residential proxies and CAPTCHA-solving services to enable bots, scrapers, and stuffers, and proposes security countermeasures for organizations.
Read more