// Home / News / Security

Microsoft: patch now or risk attack

By Stewart Mitchell

Posted on 14 Mar 2012 at 09:56

Microsoft is urging people to waste no time in applying its latest security patch, warning that it expects to see exploits targeting vulnerabilities addressed in the update within 30 days.

According to Microsoft, update MS12-020 addresses two vulnerabilities in Microsoft’s implementation of the Remote Desktop Protocol (RDP), and one of the flaws is a remote code execution vulnerability affecting all versions of Windows.

We expect to see working exploit code developed within the next 30 days

Attackers could use the vulnerability to remotely access computers without authorisation.

Microsoft said it “strongly encouraged” users to make “a special priority of applying this particular update” because the potential rewards for attackers would make the vulnerability too tempting to ignore.

“We are not aware of any attacks in the wild and the remote desktop protocol is disabled by default,” the company said in its security blog outlining the problem and how system administrators should deal with it.

“However, due to the attractiveness of this vulnerability to attackers, we anticipate that an exploit for code execution will be developed in the next 30 days.”

Microsoft said attackers could exploit the vulnerability over networks before authentication was required because “RDP is commonly allowed through firewalls due to its utility”.

The service runs in kernel-mode as SYSTEM by default on almost all platforms, the company said.

“We determined that this vulnerability is directly exploitable for code execution,” Microsoft said.

“Developing a working exploit will not be trivial – we would be surprised to see one developed in the next few days. However, we expect to see working exploit code developed within the next 30 days.”

Subscribe to PC Pro magazine. We'll give you 3 issues for £1 plus a free gift - click here

User comments

Really?

'...warning that it expects to see exploits of patched vulnerabilities within 30 days...'

Am I reading that wrong, or should that be 'un-patched'?

By synaptic_fire on 14 Mar 2012

Really?

'...warning that it expects to see exploits of patched vulnerabilities within 30 days...'

Am I reading that wrong, or should that be 'un-patched'?

By synaptic_fire on 14 Mar 2012

Double post.

Sorry about that. I posted the first reply five mins before the second. I assumed I had forgotten to press submit the first time. Then after posting a second time, both appeared.

Problem may well be my ISP's cache.

By synaptic_fire on 14 Mar 2012

@synaptic_fire

No, you read it correctly. This was a previously not widely known bug (one the bad guys hadn't found and exploited).

Now that MS have patched it, the bad guys can analyse the code and see how they can exploit the code, which will leave those unpatched machines vulnerable to attack.

By big_D on 14 Mar 2012

@big_D

Cheers pal. That makes far more sense. Though I see it has now been edited to read a little clearer.

By synaptic_fire on 14 Mar 2012

I often wonder what information MS collects from our machines whilst its 'updating'- same with anti-virus software. A few years ago you made a conscious action to connect to the web- now we are connected all the time and consequently constantly vulnerable.

By Martin_Kay1 on 15 Mar 2012

@Martin_Kay1

Only what you tell them to collect. You agree to allow them to collect anonymous usage information, or not, when you set up the computer.

By big_D on 15 Mar 2012

@big_D

I bet they are taking an awful lot more than they let on......and whether you give them permission or not !
How can you monitor what they are taking ?
Cheers

By greenee on 15 Mar 2012

@big_D

I bet they are taking an awful lot more than they let on......and whether you give them permission or not !
How can you monitor what they are taking ?
Cheers

By greenee on 15 Mar 2012

NATed connections

Most home users will be unaffected, unless ISPs have been issuing routers with port 3389 forwarded.

By S_Elwell on 16 Mar 2012

Checking the installed patch

Does anyone know the reference number for this patch so we can check it has installed? They seem to start KB.... or the definition number?

By Gz_peterbird38e3 on 16 Mar 2012

Reply to: Checking the installed patch

@Gz_peterbird38e3
For people with typical Windows desktop OSs it will be either KB2621440 or KB2667402.
For info see here: http://technet.microsoft.com/en-us/security/bullet
in/ms12-020.
This update was included in the March 2012 Microsoft Update cycle that was released earlier this week.
Hope this helps.