Microsoft patches seven distinct vulnerabilities
Posted on 13 March 2012.
We have a total of six bulletins from Microsoft this month, addressing seven distinct vulnerabilities.

It's a pretty light month, but all of your focus should be on MS12-020, a critical vulnerability in Microsoft's Remote Desktop Protocol (RDP) implementation.

RDP is a popular method for controlling remote Windows machines, however it is not active by default on standard Windows installations. It needs to be configured and started by the system's owner, which then makes the vulnerability accessible; consequently we expect that only a relatively small percentage of machines will have RDP up and running.

The vulnerability itself is accessible through the network, does not require authentication and allows code execution on the targeted machine, a highly prized combination by attackers. Microsoft has rated its exploitability index as 1, meaning that they expect working exploits to be out in fewer than 30 days.

Here are our recommendations for the RDP vulnerability:

1. Within the week apply the patch on your Windows machines that are running the RDP service and are Internet facing (you can scan for port 3389 on your perimeter if you do not have an updated map). Please note that the patch requires a reboot to become active. If you cannot apply the patch or reboot your machines, take the following countermeasures:
  • Configure the firewalls on the machines so that only trusted IPs can access port 3389
  • Activate the Network Layer Authentication (NLA) protocol, which does not have this vulnerability. NLA is available on Vista and above on the server side and client side, and Windows XP can be made NLA compatible by installing a software package from Microsoft.
2. Within the month patch the rest of your systems - both external and internal. While the main attack vector is directly through the Internet, it is likely that malware will be equipped with the exploit for the RDP vulnerability, and that it will be used for internal malware propagation.

Microsoft's five other vulnerabilities are less severe and should be applied within your normal patch cycles if the involved software is installed. For example, MS12-017 is a Denial of Service attack against Microsoft DNS server; MS12-022 is a DLL preloading attack against Expression Design; and MS12-021 is an add-in weakness in Visual Studio.

The only vulnerability publicly known is MS12-019, which is an attack against DirectWrite in the Windows Font system and can cause a DoS condition.


Author: Wolfgang Kandek, CTO, Qualys.





Spotlight

The context-aware security lifecycle and the cloud

Posted on 25 November 2014.  |  Ofer Wolf, CEO at Sentrix, explains the role of the context-aware security lifecycle and illustrates how the cloud is shaping the modern security architecture.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Nov 26th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //