March Patch Tuesday 2012

We have a total of six bulletins from Microsoft this month, addressing seven distinct vulnerabilities. It’s a pretty light month, but all of your focus should be on MS12-020, a critical vulnerability in Microsoft’s Remote Desktop Protocol (RDP) implementation. RDP is a popular method for controlling remote Windows machines, however it is not active by default on standard Windows installations. It needs to be configured and started by the system’s owner, which then makes the vulnerability accessible; consequently we expect that only a relatively small percentage of machines will have RDP up and running. The vulnerability itself is accessible through the network, does not require authentication and allows code execution on the targeted machine, a highly prized combination by attackers. Microsoft has rated its exploitability index as 1, meaning that they expect working exploits to be out in fewer than 30 days.

Here are our recommendations for the RDP vulnerability to stay ahead of expected attacks:

1. Within the week apply the patch on your Windows machines that are running the RDP service and are Internet facing (you can scan for port 3389 on your perimeter if you do not have an updated map). Please note that the patch requires a reboot to become active. If you cannot apply the patch or reboot your machines, take the following countermeasures:
   • Configure the firewalls on the machines so that only trusted IPs can access port 3389
   • Activate the Network Layer Authentication (NLA) protocol, which does not have this vulnerability. NLA is available on Vista and above on the server side and client side, and Windows XP can be made NLA compatible by installing a software package from Microsoft.
2. Within the month patch the rest of your systems – both external and internal. While the main attack vector is directly through the Internet, it is likely that malware will be equipped with the exploit for the RDP vulnerability, and that it will be used for internal malware propagation.

Microsoft’s five other vulnerabilities are less severe and should be applied within your normal patch cycles if the involved software is installed. For example, MS12-017 is a Denial of Service (DoS) attack against Microsoft DNS server; MS12-022 is a DLL preloading attack against Expression Design; and MS12-021 is an add-in weakness in Visual Studio. The only vulnerability publicly known is MS12-019, which is an attack against DirectWrite in the Windows Font system and can cause a DoS condition.