Microsoft Remote Desktop Protocol (RDP) insecurely deallocates memory

2012-03-16T00:00:00
ID VU:624051
Type cert
Reporter CERT
Modified 2015-09-17T20:32:00

Description

Overview

The Microsoft Remote Desktop Protocol (RDP) service contains a double-free vulnerability that could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

The Microsoft Remote Desktop Protocol (RDP) provides a remote graphical interface to Microsoft Windows systems. Microsoft Security Bulletin MS12-020 describes a remote code execution vulnerability in the RDP service. TippingPoint Zero Day Initiative advisory ZDI-12-044 indicates the vulnerability is caused by a double-free condition that occurs when RDP handles an error and aborts a connection.

MS12-020 also describes a denial-of-service vulnerability (CVE-2012-0152).


Impact

A remote, unauthenticated attacker could execute arbitrary code with the privileges of the RDP driver, effectively taking complete control of a vulnerable system.


Solution

Apply an update

Apply the appropriate updates as described in MS12-020.


Enable Network Level Authentication (NLA)

NLA requires authentication before a remote desktop session is created. This means an attacker would have to successfully authenticate before exploiting the double-free vulnerability. Note that Windows Server 2003 does not support NLA cannot connect to a Remote Desktop service that requires NLA. For more information, see Configure Network Level Authentication for Remote Desktop Services Connections.

Authenticate RDP connections using independent protocols

Use other secure network protocols to authenticate users before allowing RDP connections. Microsoft provides KB articles that describe how to use IPsec to secure RDP connections on Windows 2000 and Windows Server 2003. Many types of VPN can be used to authenticate users, and RDP traffic can be tunneled over SSH if an SSH daemon is installed on the RDP server.

Change RDP listening port

Changing the listening port used by RDP (3389/tcp) will not protect against attacks, but may hide RDP servers from scanning that targets the default port. See How to change the listening port for Remote Desktop.

Restrict access

Restrict RDP server access to trusted hosts and networks.


Vendor Information

624051

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Vendor has issued information

__ Sort by: Status Alphabetical

Expand all

Affected Unknown __ Unaffected

Javascript is disabled. Click here to view vendors.

Microsoft Corporation

Updated: March 15, 2012

Status

__ Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Please see Microsoft Security Bulletin MS12-020.

Vendor References

  • <http://technet.microsoft.com/en-us/security/bulletin/ms12-020>
  • <http://blogs.technet.com/b/srd/archive/2012/03/13/cve-2012-0002-a-closer-look-at-ms12-020-s-critical-issue.aspx>

CVSS Metrics

Group | Score | Vector
---|---|---
Base | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal | 7.8 | E:POC/RL:OF/RC:C
Environmental | 5.9 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

  • <http://technet.microsoft.com/en-us/security/bulletin/ms12-020>
  • <http://aluigi.org/adv/termdd_1-adv.txt>
  • <http://www.zerodayinitiative.com/advisories/ZDI-12-044/>
  • <http://blogs.technet.com/b/srd/archive/2012/03/13/cve-2012-0002-a-closer-look-at-ms12-020-s-critical-issue.aspx>
  • <http://msdn.microsoft.com/en-us/library/aa383015(v=VS.85).aspx>
  • <http://technet.microsoft.com/en-us/library/cc732713.aspx>
  • <http://support.microsoft.com/kb/315055>
  • <http://support.microsoft.com/kb/816521>
  • <http://support.microsoft.com/kb/306759>
  • <https://www.securecoding.cert.org/confluence/display/seccode/MEM31-C.+Free+dynamically+allocated+memory+exactly+once>
  • <http://cwe.mitre.org/data/definitions/415.html>
  • <http://aluigi.org/adv/ms12-020_leak.txt>

Acknowledgements

Microsoft credits Luigi Auriemma, via TippingPoint's Zero Day Initiative.

This document was written by Art Manion based on information from MS12-020 and ZDI-12-044.

Other Information

CVE IDs: | CVE-2012-0002, CVE-2012-0152
---|---
Severity Metric:** | 12.29
Date Public:
| 2012-03-13
Date First Published: | 2012-03-16
Date Last Updated: | 2015-09-17 20:32 UTC
Document Revision: | 24