5 ms·
That's not terribly difficult
by inetknght 5y ago
That's not terribly difficult
- magicalhippo 5y agoYeah I'm worried here, as our support team uses RDP to log into on-prem servers to a huge number of customers. Some have already been hit with ransomware, so clearly have less than ideal IT security. If one of their servers gets compromised, it would be bad for us. Granted most RDP sessions happen in a VM due to the VPN needed, but that's not a huge comfort.
- belltaco 5y agoThis was patched back in Aug. Why are you worried? Does your support team not even install four month old Windows Updates? Edit: Downvotes why?
- magicalhippo 5y agoMaybe some have not updated all their VMs yet. They have 3-4 VMs each due to VPN incompatibility, not all are used as frequent.
- inetknght 5y agoUpdates frequently ruin your configurations, opt-outs, and even install additional spyware. Microsoft has sabotaged trust in their updates system.
- lostmsu 5y agoI don't think there's even a protocol handler that would start connection without confirmation.
- tinus_hn 5y agoYou can offer .rdp files for download and they will automatically open in the app. The app will tell you not to open untrusted files but the warning is not too scary.
- belltaco 5y agoIt needs to transfer 4GB over the wire first.
- tinus_hn 5y agoWith compression that doesn’t have to be a big hurdle.
- malcolmst 5y agoIt doesn’t actually have to transfer all 4GB, since you’re just spoofing a header to claim that 4GB is available. The actual payload can be much smaller (like a few kB)
- malcolmst 5y agoI was trying to use this same vuln for information disclosure since it also has an out-of-bounds read due to that lack of validation, but couldn’t get the extra data to be transferred back to the server. Would’ve been a nice way to defeat ASLR if it had worked
- deleted 5y ago[deleted]