[Microsoft]Proof-of-Concept Code available for MS12-020

Discussion in 'other security issues & news' started by ronjor, Mar 16, 2012.

Thread Status:
Not open for further replies.
  1. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    59,786
    Location:
    Texas
    https://blogs.technet.com/b/msrc/ar...e-available-for-ms12-020.aspx?Redirected=true
     
    ronjor, Mar 16, 2012
    #1
  2. siljaline

    siljaline Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    Thumbs for this, Ron :thumb:

    More on the POC (Proof of Concept), Microsoft offers bounty for RDP exploit.
     
    Last edited: Mar 16, 2012
    siljaline, Mar 16, 2012
    #2
  3. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,256
    Location:
    Surrey, England.
    https://threatpost.com/en_us/blogs/...stery-deepens-microsoft-remains-silent-031612
     
    Dermot7, Mar 16, 2012
    #3
  4. siljaline

    siljaline Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    siljaline, Mar 16, 2012
    #4
  5. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,148
    This was patched on Tuesday. The Fix-It is for server admins who don't want to deploy a patch without properly testing it.

    If you want to read about the leak, go to the source:
    http://aluigi.org/adv/ms12-020_leak.txt
     
    Hungry Man, Mar 16, 2012
    #5
  6. siljaline

    siljaline Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    Despite the he-said-she-said :ouch: The threat is real.

     

    Attached Files:

    • RDP.jpg
      RDP.jpg
      File size:
      68.5 KB
      Views:
      36
    Last edited: Mar 17, 2012
    siljaline, Mar 17, 2012
    #6
  7. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    3,972
    Location:
    California
    A comment in a recent ISC Diary sums it up nicely:

    Why We Rated the MS12-020 Issue with RDP "Patch Now"
    http://isc.sans.edu/diary.html?storyid=12781
    On the other hand, as another commenter points out, it's a no-threat if the organization has proper perimeter security in place. (My translation: a System Administrator who is doing her/his job)

    Of course, with a Patch now released, the above should be moot.

    On the other hand #2: Remember Conficker -- that worm appeared on the scene 11 days after the patch for MS08-067 was released, and didn't peak until a few months later.

    (Translation offered free of charge: patches don't work unless they are installed.)

    ----
    rich
     
    Rmus, Mar 18, 2012
    #7
  8. Newby

    Newby Registered Member

    Joined:
    Jan 12, 2007
    Posts:
    153
    A friend has setup my computer (it is windows 7 pro version). All is in grey?
    Does this mean everything is disabled and not vulnarable to the exploit?
     

    Attached Files:

    Newby, Mar 18, 2012
    #8
  9. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    59,786
    Location:
    Texas
    https://www.networkworld.com/news/2...mes-security-info-sharing-program-257397.html
     
    ronjor, Mar 18, 2012
    #9
  10. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    59,786
    Location:
    Texas
    If you keep your computer updated with Windows Update, you should be okay.
     
    ronjor, Mar 18, 2012
    #10
  11. Trooper

    Trooper Registered Member

    Joined:
    Jan 26, 2005
    Posts:
    3,393
    Trooper, Mar 19, 2012
    #11
  12. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    59,786
    Location:
    Texas
    You're okay if you keep you Windows Updates current.
     
    ronjor, Mar 19, 2012
    #12
  13. Trooper

    Trooper Registered Member

    Joined:
    Jan 26, 2005
    Posts:
    3,393
    Thanks Ron.

    We're all set here then at work.

    Cheers! :cool:
     
    Trooper, Mar 19, 2012
    #13
  14. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,256
    Location:
    Surrey, England.
    http://dankaminsky.com/2012/03/18/rdp/
     
    Dermot7, Mar 19, 2012
    #14
  15. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,148
    I agree with Dan 100%. Victim blaming is probably the most common trend in IT. "Well they clicked the link so they deserve it blah blah blah they didn't update the patch so they deserve it." It's ridiculous.
     
    Hungry Man, Mar 19, 2012
    #15
  16. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,256
    Location:
    Surrey, England.
    Dermot7, Mar 20, 2012
    #16
  17. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,256
    Location:
    Surrey, England.
    https://www.f-secure.com/weblog/archives/00002338.html
     
    Dermot7, Mar 27, 2012
    #17
  18. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,256
    Location:
    Surrey, England.
    Dermot7, May 3, 2012
    #18
Loading...
Similar Threads
  1. ronjor

    OpenVPN Patches Critical Remote Code Execution Vulnerability

    ronjor, Jun 21, 2017
    Replies:
    0
    Views:
    100
    ronjor
    Jun 21, 2017
  2. itman

    Microsoft Word - '.RTF' Remote Code Execution

    itman, Apr 25, 2017
    Replies:
    0
    Views:
    118
    itman
    Apr 25, 2017
  3. itman

    Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution

    itman, Apr 25, 2017
    Replies:
    0
    Views:
    100
    itman
    Apr 25, 2017
  4. Minimalist

    Japan plans to develop a hack-proof satellite system

    Minimalist, Apr 5, 2017
    Replies:
    0
    Views:
    114
    Minimalist
    Apr 5, 2017
  5. Minimalist

    Microsoft announces general availability of Web Application Firewall in Azure

    Minimalist, Apr 2, 2017
    Replies:
    0
    Views:
    146
    Minimalist
    Apr 2, 2017
Thread Status:
Not open for further replies.