Microsoft Windows Remote Desktop Protocol Server Private Key Disclosure Vulnerability

Bugtraq ID:	13818
Class:	Design Error
CVE:	CVE-2005-1794
Remote:	Yes
Local:	No
Published:	May 30 2005 12:00AM
Updated:	Jul 12 2009 02:56PM
Credit:	Discovery is credited to Massimiliano Montoro <[email protected]>.
Vulnerable:	Microsoft RDP 5.2 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft RDP 5.1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional Microsoft RDP 5.0 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Advanced Server SP2 + Microsoft Windows 2000 Advanced Server SP2 + Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Datacenter Server SP2 + Microsoft Windows 2000 Datacenter Server SP2 + Microsoft Windows 2000 Datacenter Server SP1 + Microsoft Windows 2000 Datacenter Server SP1 + Microsoft Windows 2000 Datacenter Server + Microsoft Windows 2000 Datacenter Server + Microsoft Windows 2000 Professional SP3 + Microsoft Windows 2000 Professional SP3 + Microsoft Windows 2000 Professional SP2 + Microsoft Windows 2000 Professional SP2 + Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Server SP3 + Microsoft Windows 2000 Server SP3 + Microsoft Windows 2000 Server SP2 + Microsoft Windows 2000 Server SP2 + Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server + Microsoft Windows 2000 Terminal Services SP3 + Microsoft Windows 2000 Terminal Services SP3 + Microsoft Windows 2000 Terminal Services SP2 + Microsoft Windows 2000 Terminal Services SP2 + Microsoft Windows 2000 Terminal Services SP1 + Microsoft Windows 2000 Terminal Services SP1 + Microsoft Windows 2000 Terminal Services + Microsoft Windows 2000 Terminal Services Microsoft RDP 4.0 + Microsoft Windows NT Terminal Server 4.0 SP6a + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP6 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP2 + Microsoft Windows NT Terminal Server 4.0 SP2 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0
Not Vulnerable:

Microsoft Windows Remote Desktop Protocol Server Private Key Disclosure Vulnerability

The vulnerability presents itself because a private key that is used to sign the Terminal Server public key is hardcoded in a DLL.

This can allow the attacker to disclose the key and calculate a valid signature to carry out man in the middle attacks.

An attacker could therefore cause the client to connect to a server under their control and send the client a public key to which they possess the private key.

Microsoft Windows Remote Desktop Protocol Server Private Key Disclosure Vulnerability

An exploit to leverage this issue is available as a part of Cain & Abel version 2.7.

Microsoft Windows Remote Desktop Protocol Server Private Key Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Windows Remote Desktop Protocol Server Private Key Disclosure Vulnerability

References:

• Remote Desktop Protocol, the Good the Bad and the Ugly (Massimiliano Montoro )