Microsoft released their security bulletin MS12-020 which they label as Critical, and document two vulnerabilities in the RDP implementation in all modern version of Windows. One of these is a network level pre-authentication vulnerability and could be exploited to gain system level access to compromise a server. Microsoft's blog report on the vulnerability anticipates exploit within the next 30 days. The only mitigating factor is that RDP is disabled by default, and administrators will have had to explicitly enable it and make it accessible to the Internet. We recommend all customers and users of Microsoft products to be aware of and respond to this problem. Best practices would be to:

1. To read the Microsoft bulletin and blog.
2. Apply the Microsoft Patches immediately.
3. Firewall and close down port tcp/3389 to the Internet.
4. Use a VPN, or at least a defined small set of static source IPs, for remote access to your network resources.

BackgroundMicrosoft's RDP (Remote Desktop Protocol) allows administrators to remotely access their windows servers and desktops for maintenance and support purposes. It is incredibly convenient and opening it up for access from the Internet allows user anywhere to connect back to their office and data centre systems as if they were there.

Back