• Articles
    • Editorial Articles
    • Research Articles
    • WatchGuard Articles
  • The 443 Podcast
  • Threat Landscape
  • About
    • About Us
    • Contact Us
    • Contribute to Secplicity

Secplicity - Security Simplified

Powered by WatchGuard Technologies

Windows Updates Fix Critical RDC Flaw, and More

April 9, 2013 By Corey Nachreiner

Severity: High

Summary:

  • These vulnerabilities affect: All current versions of Windows and some of the components that ship with it
  • How an attacker exploits them: Multiple vectors of attack, including luring users to web sites with malicious code or sending specially crafted network packets
  • Impact: In the worst case, an attacker can gain complete control of your Windows computer.
  • What to do: Install the appropriate Microsoft patches as soon as possible, or let Windows Update do it for you.

Exposure:

Today, Microsoft released six security bulletins that describe around ten vulnerabilities affecting Windows or components related to it, such as Remote Desktop Client, Active Directory, and the Antimalware client (part of Windows Defender in Windows 8). Each of these vulnerabilities affect different versions of Windows to varying degrees. A remote attacker could exploit the worst of these flaws to gain complete control of your Windows PC. We recommend you download, test, and deploy these updates – especially the critical ones – as quickly as possible.

The summary below lists the vulnerabilities, in order from highest to lowest severity.

  • MS13-029: Remote Desktop Client Code Execution Vulnerability

Remote Desktop Protocol (RDP) is a Microsoft networking protocol that allows you to view and control the desktop of one Windows computer from another networked computer. Windows ships with the Remote Desktop Client to support this functionality. According to Microsoft, an ActiveX control the Remote Desktop Client uses suffers from a “use after free” vulnerability, which remote attackers can exploit to execute arbitrary code on your system. The attacker would simply have to entice you to a web site containing malicious code to trigger the flaw. As is typical with Windows vulnerabilities, the attacker would gain your privileges, and if you’re a local administrator that means full control of your system.

Microsoft rating: Critical

  • MS13-031: Two Kernel Elevation of Privilege Vulnerabilities

The kernel is the core component of any computer operating system. The Windows kernel suffers from two race condition vulnerabilities, which attackers can leverage to  elevate their privilege. Though the flaws differ technically, the share the same scope and impact. By running a specially crafted program, a local attacker could exploit this flaw to gain complete control of your PC. However, the attacker would first need to gain local access to your Windows computer using valid credentials. This factor significantly reduces the severity of the issue

Microsoft rating: Important

  • MS13-032: Active Directory Memory Consumption Flaw

Active Directory (AD) provides central authentication and authorization services for Windows computers and ships with server versions of Windows. AD suffers from a memory consumption vulnerability having to do with it’s inability to properly handle specially crafted LDAP queries. By sending a malicious LDAP query to an AD server, an attacker can exploit this flaw to force the server’s LDAP service to stop responding, putting it into a Denial of Service (DoS) state. However, administrators typically limit LDAP access to their local network, so this vulnerability primarily poses an internal threat.

Microsoft rating: Important

  • MS13-033: CSRSS Elevation of Privilege Vulnerability

The Client/Server Run-time SubSystem (CSRSS) is an essential Windows component responsible for console windows and creating and deleting threads. It suffers from a local privilege elevation issue. By running a specially crafted application, an attacker can leverage this flaw to execute code with full system privileges, regardless of his actual user privilege. However, in order to run his special program, the attacker would first need to gain local access to your Windows computers using valid credentials. This factor significantly reduces the risk of this flaw.

Microsoft rating: Important

  • MS13-034: Antimalware Client Elevation of Privilege Vulnerability

The Antimalware Client is a free host-based security program that does just what you’d expect; protects Windows systems from malicious software (viruses, worms, trojans, etc.) loosely known as malware. It ships with Windows Defender, which comes with Windows 8. It also suffers from a local privilege elevation issue having to do with its inability to handle improper pathnames. By running a specially crafted application, an attacker can leverage this flaw to execute code with full system privileges, regardless of his actual user privilege. However, in order to run his special program, the attacker would first need to gain local access to your Windows computers using valid credentials, which significantly reduces the risk of this flaw. This issue primarily affects Windows 8 computers.

Microsoft rating: Important

  • MS13-036: Multiple Kernel-Mode Driver Vulnerabilities

As mentioned above, the kernel is the core component of any computer operating system. Windows also ships with a kernel-mode device driver (win32k.sys), which handles the OS’s device interactions at a kernel level. The Windows kernel-mode driver suffers five different privilege elevation vulnerabilities. The vulnerabilities differ technically  but share the same scope and impact. By running a specially crafted program, a local attacker can leverage any of these flaws to gain complete control of your Windows computers. However, in order to run his malicious program, the attacker would first need to gain local access to your computer or trick you into running the program yourself, which significantly lessens the severity of these issues.

Microsoft rating: Important

Solution Path:

Microsoft has released Windows updates that correct all of these vulnerabilities. You should download, test, and deploy the appropriate updates throughout your network immediately. If you choose, you can also let Windows Update automatically download and install them for you.

The links below point directly to the “Affected and Non-Affected Software” section of each bulletin, where you can find links to the various updates:

  • MS13-029
  • MS13-031
  • MS13-032
  • MS13-033
  • MS13-034
  • MS13-036

For All WatchGuard Users:

WatchGuard’s Gateway Antivirus and Intrusion Prevention services can often prevent these sorts of attacks, or the malware they try to distribute. For instance, our IPS signature team has developed a new signature that can detect and block the Remote Desktop Client vulnerability described above:

  • WEB-ACTIVEX Microsoft RDC ActiveX Control Remote Code Execution Vulnerability (CVE-2013-1296)

Your XTM appliance should get this new IPS update shortly.

Nonetheless, attackers can exploit some of these flaws in other ways, including by convincing users to run executable files locally. Since your gateway appliance can’t protect you against local attacks, we still recommend you install Microsoft’s updates to completely protect yourself from these flaws.

Status:

Microsoft has released patches correcting these issues.

References:

  • Microsoft Security Bulletin MS13-029
  • Microsoft Security Bulletin MS13-031
  • Microsoft Security Bulletin MS13-032
  • Microsoft Security Bulletin MS13-033
  • Microsoft Security Bulletin MS13-034
  • Microsoft Security Bulletin MS13-036

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).


What did you think of this alert? Let us know at [email protected].

Share This:

Related

Filed Under: Security Bytes Tagged With: Antimalware, elevation of Privilege, IPS, Kernel-mode drivers, Microsoft, RDC, RDP, Updates and patches, Windows 8, Windows Defender

Comments

  1. Alexander Kushnarev (Rainbow Security) says

    April 11, 2013 at 8:25 pm

    Not for the first time I’ve read about problems, related to Remote Desktop ActiveX control (TSWeb) library (MS 13-029) – mstscax.dll. I’ve personally faced (though I’m not talking about vulnerabilities now) with couple of troubles with it. First – with error “Remote Desktop Web Connection ActiveX control is not installed”, and it require re-register this library with regsvr32. Second – with a problem then “The terminal services activex control (mstscax.dll) does not match the version of the client shell”, and you need to substitute mstscax.dll in safe-mode. Now – critical vulnerability.

    Reply
  2. Hosted Desktop Services says

    September 21, 2014 at 5:56 am

    Hi, everything is going nicely here and ofcourse every one is
    sharing data, that’s in fact good, keep up writing.

    Reply
  3. Tasha says

    September 26, 2014 at 8:06 am

    Hey there! Do you kno if they make any plugins to help with Search Engine Optimization? I’m trying to get my blog to
    rank for some targeteed keywords but I’m not seeing very good results.
    If you know of any please share. Thank you!

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

The 443 Podcast

A weekly podcast featuring the leading white-hat hackers and security researchers. Listen Now
the 443 podcast

Threat Landscape

Filter and view Firebox Feed data by type of attack, region, country, and date range. View Now
threat landscape

Top Posts

  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
  • US National Cybersecurity Strategy
  • Here Come The Regulations
  • Cybersecurity’s Toll on Mental Health

Email Newsletter

Sign up to get the latest security news and threat analysis delivered straight to your inbox

By signing up you agree to our Privacy Policy.


The views and opinions expressed on this website are those of the authors and do not necessarily reflect the policy or position of WatchGuard Technologies.

Stay in Touch

Recent Posts

  • Cybersecurity News: LastPass Incident Revealed, White House Issues Cybersecurity Strategy, FBI Purchases Leaked USHOR PII Data, and a Slew of Other Breaches
  • An Update on Section 230
  • Here Come The Regulations
  • US National Cybersecurity Strategy
  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
View All

Search

Archives

Copyright © 2023 WatchGuard Technologies · Cookie Policy · Privacy Policy · Terms of Use