Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.0566
MS15-030: Vulnerability in Remote Desktop Protocol Could
Allow Denial of Service
11 March 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Microsoft Windows
Publisher: Microsoft
Operating System: Windows
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2015-0079
Original Bulletin:
https://technet.microsoft.com/en-us/library/security/MS15-030
- --------------------------BEGIN INCLUDED TEXT--------------------
Bulletin Number: MS15-030
Bulletin Title: Vulnerability in Remote Desktop Protocol Could Allow Denial of
Service
Severity: Important
KB Article: 3039976
Version: 1.0
Published Date: March 10, 2015
Description: This security update resolves a vulnerability in Microsoft
Windows. The vulnerability could allow denial of service if an attacker
creates multiple Remote Desktop Protocol (RDP) sessions that fail to properly
free objects in memory. By default, RDP is not enabled on any Windows
operating system. Systems that do not have RDP enabled are not at risk.
Executive Summary
This security update resolves a vulnerability in Microsoft Windows. The
vulnerability could allow denial of service if an attacker creates multiple
Remote Desktop Protocol (RDP) sessions that fail to properly free objects in
memory. By default, RDP is not enabled on any Windows operating system.
Systems that do not have RDP enabled are not at risk.
This security update is rated Important for all supported editions of Windows
7, Windows 8, Windows Server 2012, Window 8.1, and Windows Server 2012 R2.
Affected Software
The following software versions or editions are affected.
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)
Vulnerability Information
Remote Desktop Protocol (RDP) Denial of Service Vulnerability - CVE-2015-0079
A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when
an attacker creates multiple RDP sessions that fail to properly free objects
in memory. Note that the denial of service would not allow an attacker to
execute code or to elevate their user rights. However, it could prevent
legitimate users from logging on through remote desktop. An unauthenticated
attacker could use this vulnerability to exhaust the system memory by creating
multiple RDP sessions. An attacker who successfully exploited the
vulnerability could cause the target system to stop responding. The update
addresses the vulnerability by correcting how RDP manages objects in memory.
Microsoft received information about this vulnerability through coordinated
vulnerability disclosure. When this security bulletin was issued, Microsoft
had not received any information to indicate that this vulnerability had been
publicly used to attack customers.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVP+brBLndAQH1ShLAQJDlhAAktO6Bm6RdiBP5csbcPL/knqaF3N3vxY7
WRw4ijM/REZUgfAnyn/PdIpBMCHFDPgjlGbo8BZJcLOLMqzBE76WgpQJPTzjcrki
0DyQj2s7WIwfAt1fahwvJ/MVtAWih/ZseeEhcZ5ygQrSaObU3FLE87aefEcqMLxr
jWmA9ACMy/gVxPiWfP2NX8AeOzSTa/0p9p0NtThLkvURoOaGN3DidqVJp9yZwpVa
Y4tp0EAu/SUIln74L69xVNSbKIkmlIlD6e4OY7j5P65hU++S53QIBq2NCbdrWEIi
9UCwQgF38mkVVi9n6eVB3O2ZDm65QB8ho75LzU0B+iDQakZ2/pgErbEc6QB4kQBE
5Zc5u+SW8EnPzHdWhyG6uaqw6dDQeOZUf3hNsNrfUI8je5RpgJjyZ/6LVH0zSAws
CXa3uyBUPdJOJeUJqjEf/aE8eGW27gWxbPD+pfQwxnxH+5S0eSj4teT8AvUbGPPH
Yw1XvM8O5+/wqY3fpPd1QNkhTvr+cz36emvzRIynIsvSSE7FAm6554s5caVOT3mo
Yg5GgOrXls17Qljoe+pSTgJXsE+Zt73J7GzEB3CkuVTtbSzp9LnW59iTPDGDdbek
QrNaNCwReYDYqzBTM++pdfrMLxnwx8m8EZcUz8kDrsQMiJPsqZ72wpkaWxtV5rVa
qPcDuwJouAk=
=6hW/
-----END PGP SIGNATURE-----