Microsoft is releasing a patch as part of its monthly security updates that should be noted. The cirtical vulnerability is known as <strong>CVE-2012-002</strong>, and it boils down to an exploit in RDP that could allow an attacker to gain access via RDP without authenticating.

The issue is potentially reachable and accessible as RDP is enabled through many firewalls for remote management, and an attacker could reach the network in question before authentication is required. Microsoft privately self reported the problem first and noted that they have not seen it in the wild, but followed up with a comment on <a title="CVE-2012-0002: A closer look at MS12-020's critical issue" href="http://blogs.technet.com/b/srd/archive/2012/03/13/cve-2012-0002-a-closer-look-at-ms12-020-s-critical-issue.aspx" target="_blank">Technet</a>, that they do expect to see an exploitable execution code within the next 30 days.

&nbsp;

Steps to resolve the issue:

1. Apply the <a title="Microsoft Security Bulletin MS12-020 - Critical" href="http://technet.microsoft.com/en-us/security/bulletin/ms12-020" target="_blank">update</a> on machines with RDP enabled

2. Enable Network Level Authentication (NLA) on Windows Vista or later machines. Here is a direct link to <a href="http://go.microsoft.com/?linkid=9803082" target="_blank">Microsoft's Fix It 50844</a>
<ul>
	<li>The Fix IT above is a simple MSI package that enumerates each of the “listener” registry subkeys under HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations and sets the “UserAuthentication” REG_DWORD to 1</li>
</ul>
&nbsp;

Note: Enabling NLA will prevent older cilents (XP &amp; Server 2003) from connecting because they do not support NLA. If you need to initiate an RDP connection from an XP client, be sure to install the <a title="Description of the Credential Security Support Provider (CredSSP) in Windows XP Service Pack 3" href="http://support.microsoft.com/kb/951608" target="_blank">CredSSP</a>.

&nbsp;

For more information, please visit Microsoft's <a title="CVE-2012-0002: A closer look at MS12-020's critical issue" href="http://blogs.technet.com/b/srd/archive/2012/03/13/cve-2012-0002-a-closer-look-at-ms12-020-s-critical-issue.aspx" target="_blank">Technet Article</a> for the latest.