Microsoft Remote Desktop Protocol 'ieframe.dll' DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	42853
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2010 12:00AM
Updated:	Aug 30 2010 12:00AM
Credit:	mlk3
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP3 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition SP3 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 0 Microsoft Windows XP 0
Not Vulnerable:

Microsoft Remote Desktop Protocol 'ieframe.dll' DLL Loading Arbitrary Code Execution Vulnerability

Microsoft Remote Desktop Protocol is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Microsoft Remote Desktop Protocol 'ieframe.dll' DLL Loading Arbitrary Code Execution Vulnerability

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

Microsoft Remote Desktop Protocol 'ieframe.dll' DLL Loading Arbitrary Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Remote Desktop Protocol 'ieframe.dll' DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Microsoft Homepage (Microsoft)
  
• Microsoft Security Advisory 2269637 Released (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• Microsoft Security Advisory (2269637) (Microsoft)