Last week (Tuesday, March 13, 2012), Microsoft released a security bulletin detailing a fairly severe vulnerability in their Remote Desktop Protocol which is present in all versions of it from Windows XP to Windows Server 2008 R2.  At the time there was no functional exploit code in the wild, but the potential risk surrounding this vulnerability was marked as “Critical.”  The following is a snippet from their own write-up of the security vulnerability:

“This security update resolves two privately reported vulnerabilities in the Remote Desktop Protocol. The more severe of these vulnerabilities could allow remote code execution if an attacker sends a sequence of specially crafted RDP packets to an affected system. By default, the Remote Desktop Protocol (RDP) is not enabled on any Windows operating system. Systems that do not have RDP enabled are not at risk.”

The bolded text was added by us.  Security vulnerabilities with the potential to allow remote code execution are some of the most severe around.  This means that given the appropriate sequence of packets, an attacker could do anything from creating their own users to simply shutting the server down, without providing as much as a password. Due to these threats, secure data is a must!

Microsoft released a patch for this vulnerability the same day as the security bulletin, and if your servers are currently configured to perform automatic updates, you are likely in the clear for this particularly nasty hole.  However, if you are managing your patches yourself and haven’t gotten around to addressing this one, it would be in your best interest to do so as soon as possible.

At the time the patch was released, no functional exploit code was available.   Since then, however, several IT security professionals have been working to develop a proof-of-concept exploit to take advantage of unpatched systems.  The demand for this exploit even grew so great that a $1,500 bounty had been offered to the first person or team to provide a functional Metasploit security plugin.  Simply the amount of buzz around this vulnerability should be enough motivation to apply the patches as soon as possible.

A security vulnerability with such potential for damage doesn’t come out very often, but when it does, it’s a pretty big deal.  For those of you hosting with INetU, contact support to find out if your server has been patched yet, and if it has not, we can schedule a time to do so immediately.  For those of you hosting elsewhere, you too should make an effort to see that your Windows servers are safe from this vulnerability and other security issues.