News

DoS Flaw Affects Windows XP, Windows 2000, Windows 2003

• By Scott Bekker
• July 19, 2005

Microsoft is working to fix a publicly disclosed flaw in Microsoft's Remote Desktop Services that can lead to a denial of service attack against certain Windows XP, Windows 2000 and Windows Server 2003 systems.

The flaw is not the most serious type -- the remote execution flaws that can give an attacker a way to take complete control of a computer over the Internet. After investigating the flaw, Microsoft concluded that the worst result of the vulnerability is a failed system. In all affected operating systems except Windows XP Media Center Edition, the services that use the vulnerable Remote Desktop Protocol (RDP) are turned off by default.

Secunia released an advisory Thursday that the flaw had been discovered by Tom Ferris and that Windows systems were at risk. Microsoft released a security advisory on Saturday to confirm the flaw, offer workarounds and promise that a patch will be coming.

"We have not been made aware of attacks that try to use the reported vulnerability or of customer impact at this time, but we are aggressively investigating the public reports," Microsoft wrote in its security advisory. "While this issue was first reported to Microsoft responsibly, details about the reported vulnerability have been made public," the Microsoft advisory complained.

The flaw occurs in RDP, which allows users to access all their data and applications on their desktop computers through virtual sessions from other computers. RDP provides the foundation for Terminal Services in Windows 2000 and Windows Server 2003 and for Remote Desktop Sharing in Windows XP.

An attacker can exploit the flaw by crafting a special Remote Desktop request and sending the request to an affected system.

Microsoft's next regularly scheduled patching day falls on Aug. 9. Until a patch is ready, Microsoft offers several workarounds including blocking TCP port 3389 at the firewall, disabling Terminal Services or the Remote Desktop feature, securing Remote Desktop connections with an IPsec policy or securing Remote Desktop connections via a Virtual Private Network.

Click here to view Microsoft's security advisory.