News
'Critical' RDP Windows Fix Highlighted in Microsoft's March Security Update
This month's Microsoft security update, released today, features six bulletins, with one labeled as "critical," four "important" and one "moderate."
The lone critical item, bulletin MS12-020, fixes two privately reported issues in the Remote Desktop Protocol (RDP) for all versions of Windows. If exploited, attackers could initiate a remote code execution by sending "a sequence of specially crafted RDP packets to an affected system," according to the bulletin summary.
Those organizations not running RDP aren't at risk. It's a feature that has to be set up in Windows and is not turned on by default.
Due to the high exposure level associated with the two issues in this critical item, Microsoft has published a detailed a workaround. The security team recommends using it as soon as possible.
"We understand that our customers need time to evaluate and test all bulletins before applying them," wrote Angela Gunn, a Microsoft representative, in a blog post. "To provide for a bit of scheduling flexibility, we're offering a one-click, no-reboot Fix it that enables Network-Level Authentication, an effective mitigation for this issue."
The workaround, available here, will require Remote Desktop's Network Level Authentication to certify before starting a desktop session. While this workaround will block unauthorized access by the exploits, it should not be treated as a permanent fix. The workaround should be pushed to users as soon as the testing phase is complete.
Wolfgang Kandek, CTO at security firm Qualys, advises that enterprise-wide rollout of this bulletin should be completed by the end of the month to avoid the internal spread of viruses. "While the main attack vector is directly through the Internet, it is likely that malware will be equipped with the exploit for the RDP vulnerability, and that it will be used for internal malware propagation," said Kandek.
Microsoft's remaining bulletin entries for the month are recommended to be rolled out at the discretion of admins, due to the less-severe nature of the associated vulnerabilities. Here is a rundown of the remaining items:
- MS12-017: This important item affects Windows Server 2003, 2008 and 2008 R2. It fixes a denial-of-service flaw that can be taken advantage of by an attacker sending a malicious DNS query to a DNS server.
- MS12-018: Affecting multiple versions of Windows and Windows Server, this item will patch a vulnerability that could allow an elevation-of-privilege attack if a specially created application is run. This bulletin is just classified as "important" because the breach could only occur if the attacker had access to a system's correct credentials or if the attacker had local access.
- MS12-021: The third important bulletin is designed to take care of an elevation-of-privilege flaw in Microsoft Visual Studio. An attacker could install malicious code on a system if a user clicks on a specially crafted add-on in the developer software.
- MS12-022: This final important bulletin addresses a remote code execution issue in Microsoft Expression Design. An attacker could gain access to a system if a user clicks on a legitimate file that redirects to a malicious DLL file.
- MS12-019: This month's only moderate item patches an error in Windows' DirectWrite that could lead to the program crashing if a specially crafted Unicode sequence is sent through the messenger window.
An interesting side note to today's patch releases is that Mozilla, makers of the open source Firefox browser, announced it was delaying the release of Firefox 11 due to Microsoft's update. Mozilla is looking to address any compatibility issues with the new browser and the security update.
"This Tuesday is Microsoft's scheduled monthly update to Windows, and those updates have interacted badly with our updates before," said Johnathan Nightingale, senior director of Firefox. "We don't have reason to expect specific problems with this month's updates, but we'd rather take a day or two to understand the impact before we update all of our users."
More information on Microsoft's March Security Update can be found here.