DoS Flaw Affects Windows XP, Windows 2000, Windows 2003 -- Redmondmag.com

DoS Flaw Affects Windows XP, Windows 2000, Windows 2003

By Scott Bekker
07/19/2005

Microsoft is working to fix a publicly disclosed flaw in Microsoft's Remote Desktop Services that can lead to a denial of service attack against certain Windows XP, Windows 2000 and Windows Server 2003 systems.

The flaw is not the most serious type -- the remote execution flaws that can give an attacker a way to take complete control of a computer over the Internet. After investigating the flaw, Microsoft concluded that the worst result of the vulnerability is a failed system. In all affected operating systems except Windows XP Media Center Edition, the services that use the vulnerable Remote Desktop Protocol (RDP) are turned off by default.

Secunia released an advisory Thursday that the flaw had been discovered by Tom Ferris and that Windows systems were at risk. Microsoft released a security advisory on Saturday to confirm the flaw, offer workarounds and promise that a patch will be coming.

"We have not been made aware of attacks that try to use the reported vulnerability or of customer impact at this time, but we are aggressively investigating the public reports," Microsoft wrote in its security advisory. "While this issue was first reported to Microsoft responsibly, details about the reported vulnerability have been made public," the Microsoft advisory complained.

The flaw occurs in RDP, which allows users to access all their data and applications on their desktop computers through virtual sessions from other computers. RDP provides the foundation for Terminal Services in Windows 2000 and Windows Server 2003 and for Remote Desktop Sharing in Windows XP.

An attacker can exploit the flaw by crafting a special Remote Desktop request and sending the request to an affected system.

Microsoft's next regularly scheduled patching day falls on Aug. 9. Until a patch is ready, Microsoft offers several workarounds including blocking TCP port 3389 at the firewall, disabling Terminal Services or the Remote Desktop feature, securing Remote Desktop connections with an IPsec policy or securing Remote Desktop connections via a Virtual Private Network.

Click here to view Microsoft's security advisory.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.
What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.
Microsoft Kills 30-Day Data Retention Policy for Copilot in Fabric

Microsoft this week announced several usability improvements coming to Copilot in Fabric in preparation of its general availability release later this year.
Using Microsoft Office to Build a Network Diagram 2

Now that we've set up our process, let's dig in with the actual execution.
Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.