4 ms·
This is not a Windows RCE vulnerability. It is a vulnerability of RDP client (not even the server). To hack one would have to convince you to try connecting to
by lostmsu 5y ago
This is not a Windows RCE vulnerability. It is a vulnerability of RDP client (not even the server). To hack one would have to convince you to try connecting to a malicious server.
- inetknght 5y agoThat's not terribly difficult
- magicalhippo 5y agoYeah I'm worried here, as our support team uses RDP to log into on-prem servers to a huge number of customers. Some have already been hit with ransomware, so clearly have less than ideal IT security. If one of their servers gets compromised, it would be bad for us. Granted most RDP sessions happen in a VM due to the VPN needed, but that's not a huge comfort.
- belltaco 5y agoThis was patched back in Aug. Why are you worried? Does your support team not even install four month old Windows Updates? Edit: Downvotes why?
- magicalhippo 5y agoMaybe some have not updated all their VMs yet. They have 3-4 VMs each due to VPN incompatibility, not all are used as frequent.
- inetknght 5y agoUpdates frequently ruin your configurations, opt-outs, and even install additional spyware. Microsoft has sabotaged trust in their updates system.
- lostmsu 5y agoI don't think there's even a protocol handler that would start connection without confirmation.
- tinus_hn 5y agoYou can offer .rdp files for download and they will automatically open in the app. The app will tell you not to open untrusted files but the warning is not too scary.
- belltaco 5y agoIt needs to transfer 4GB over the wire first.
- tinus_hn 5y agoWith compression that doesn’t have to be a big hurdle.
- malcolmst 5y agoIt doesn’t actually have to transfer all 4GB, since you’re just spoofing a header to claim that 4GB is available. The actual payload can be much smaller (like a few kB)
- malcolmst 5y agoI was trying to use this same vuln for information disclosure since it also has an out-of-bounds read due to that lack of validation, but couldn’t get the extra data to be transferred back to the server. Would’ve been a nice way to defeat ASLR if it had worked
- deleted 5y ago[deleted]
- maccard 5y ago> To hack one would have to convince you to try connecting to a malicious server. Anecdotally, every machine I've RDP'ed to has prompted me with this [0] warning on first connection. Instructions from IT were to just click through the warning. How the hell am I supposed to vet that I'm actually connecting to the right server in that case? [0] https://techcommunity.microsoft.com/t5/image/serverpage/image-id/53441i00B36D4D472F1C4D/image-size/large?v=v2&px=999 https://techcommunity.microsoft.com/t5/image/serverpage/imag...
- meepmorp 5y agoNot being a windows person, can you explain what that error means?
- maccard 5y agoRDP connections are distributed as .rdp files which can be (but aren't often/ever) signed. If the file isn't signed you get this warning. If you spin up a windows ec2 instance and downlaod the RDP file from AWS, the file isn't signed so you get this warning, for example.
- deleted 5y ago[deleted]