ZeroBox Vulnerability Database

漏洞起因
设计错误
危险等级
中
 
影响系统
Microsoft Remote Desktop Connection Multilingual UI 6.0
Microsoft RDP 7.0
Microsoft RDP 6.1
Microsoft RDP 6.0
Microsoft RDP 5.2
 
不受影响系统
 
危害
远程攻击者可以利用漏洞以应用程序上下文执行任意代码。
 
攻击所需条件
攻击者必须构建恶意远程桌面配置媒体文件，诱使用户访问。
 
漏洞信息
Microsoft windows是一款流行的操作系统。
Microsoft远程桌面连接客户端以不安全方式装载DLL库，攻击者可以诱使用户在远程WebDAV或SMB共享上打开远程桌面配置(.rdp)文件，可以登录用户安全上下文装载任意库。
 
测试方法
 
厂商解决方案 
用户可参考如下供应商提供的安全补丁：
Microsoft RDP 6.0
Microsoft WindowsServer2003.WindowsXP-KB2481109-x64-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=6D4539EF-4A05 -4C7D-9489-436F7B7A3EBE
Microsoft WindowsServer2003-KB2481109-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=641D5D12-0790 -4551-831A-E78FEBAD17A7
Microsoft RDP 7.0
Microsoft Windows6.1-KB2483614-x86.msu
http://www.microsoft.com/downloads/details.aspx?familyid=0768A5F4-DA28 -4B2E-8AFF-D68F890DF3E6
Microsoft Windows6.1-KB2483614-ia64.msu
http://www.microsoft.com/downloads/details.aspx?familyid=C29B6487-78F0 -421C-810C-C5E45D6A2352
Microsoft Windows6.0-KB2483614-x86.msu
http://www.microsoft.com/downloads/details.aspx?familyid=3C30F67E-7C31 -4553-BA3E-E056DF1BF8EB
Microsoft Windows6.1-KB2483614-x64.msu
http://www.microsoft.com/downloads/details.aspx?familyid=935ADB10-1E7E -4501-B543-8247B88F6D18
Microsoft Windows6.0-KB2483614-x64.msu
http://www.microsoft.com/downloads/details.aspx?familyid=8025482B-F58F -4F5A-A133-5563C65B21F6
Microsoft WindowsXP-KB2483614-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=6A01992E-C9A1 -4DC9-A3EF-7410B81F17E6
Microsoft RDP 6.1
Microsoft Windows6.0-KB2481109-x64.msu
http://www.microsoft.com/downloads/details.aspx?familyid=5735BED6-0E3D -46A4-85D0-14EC34A82EDD
Microsoft Windows6.0-KB2481109-x86.msu
http://www.microsoft.com/downloads/details.aspx?familyid=E3EA7690-386B -4CDF-889F-B3914921C56F
Microsoft WindowsXP-KB2481109-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=D67E4D8C-AEB9 -45E6-9555-7456C5540475
Microsoft Windows6.0-KB2481109-ia64.msu
http://www.microsoft.com/downloads/details.aspx?familyid=25DA7E00-745D -4D98-9DD8-52A8A4340404
Microsoft RDP 5.2
Microsoft WindowsXP-KB2483618-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=1AED6080-FEAB -4B5E-9D26-6A3F4B92434D
Microsoft Remote Desktop Connection Multilingual UI 6.0
Microsoft WindowsServer2003-KB2483619-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=6FEC0D06-042D -4E55-9843-009EDD7D26CE
 
漏洞提供者
Eyal Gruner of Versafe Anti Fraud