# MA-302.032012: MyCERT Alert - Critical Vulnerability in Microsoft Windows Remote Desktop Protocol (RDP)

**Date:** 14 Mar 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-302.032012  
**Advisory ID:** MA-302.032012

---

**1.0 Introduction**
Two critical vulnerabilities (MS12-020) have been identified in the Microsoft's implementation of the Remote Desktop Protocol (RDP). Remote Desktop Protocol is a service that designed to allow remote access to Windows system Desktop.
These two vulnerabilities (MS12-020) if successfully exploited will potentially allow an attacker to run arbitrary code and take control of the affected system. These two vulnerabilities are targeting Windows Remote Desktop service. The vulnerabilities can be triggered remotely and pre-authenticate. At this time of writing, MyCERT is not aware of any 0day attack on these vulnerabilities.
The Remote Desktop Protocol service is **disabled** by default in Windows. However, MyCERT is advising the infected parties, which have RDP service running to evaluate and install the patch as appropriate to the environment.
**2.0 Impact**
The vulnerability in the Remote Desktop Protocol via Remote Desktop (RDP) service if successfully exploited will potentially allow an attacker to run arbitrary code and take control of the affected system as SYSTEM level privilege. This is due to RDP service is running over SYSTEM privilege.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2\*
- Windows Server 2008 for x64-based Systems Service Pack 2\*
- Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
- Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1\*
- Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
\*Server Core installation affected
**4.0 Recommendation4.1** Update has been released by Microsoft to patch this vulnerability. Users of this product might perform Windows Update to get the patch from the vendor. The article on how to enable the auto update feature in Microsoft is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
**4.2** Microsoft is recommending enabling of Network Level Authentication (NLA) for RDP service on Windows Vista and later platform. On systems with NLA enabled, the vulnerable code is still present and could potentially be exploited for code execution. However, NLA would require an attacker to first authenticate to the server before attempting to exploit the vulnerability. Microsoft released a tool to enable NLA and available at the following URL:
- <http://support.microsoft.com/kb/2671387>
**4.3**  MyCERT is recommending disabling unused RDP service.
MyCERT would like to advise the users of Microsoft Windows to be vigilant of the latest security announcements by Microsoft and ensure that their operating systems are automatically updated.
MyCERT can be reached through the following channels for further assistance:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#bdd0c4ded8cfc9fdd0c4ded8cfc993d2cfda93d0c4)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i. <http://technet.microsoft.com/en-us/security/bulletin/ms12-020>
ii.<http://blogs.technet.com/b/srd/archive/2012/03/13/cve-2012-0002-a-closer-look-at-ms12-020-s-critical-issue.aspx>
iii.<http://support.microsoft.com/kb/2671387>