Microsoft Remote Desktop ActiveX Control CVE-2013-1296 Remote Code Execution Vulnerability

Bugtraq ID:	58874
Class:	Design Error
CVE:	CVE-2013-1296
Remote:	Yes
Local:	No
Published:	Apr 09 2013 12:00AM
Updated:	Mar 19 2015 09:49AM
Credit:	c1d2d9acc746ae45eeb477b97fa74688 working with HP's Zero Day Initiative
Vulnerable:	Microsoft Windows XP Service Pack 3 0 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows Vista Ultimate 64-bit edition SP2 Microsoft Windows Vista Service Pack 2 0 Microsoft Windows Server 2008 R2 Itanium SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems 0 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems R2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for x64-based Systems 0 Microsoft Windows 7 for 32-bit Systems 0 Microsoft RDP 7.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition Microsoft RDP 6.1 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya Communication Server 1000 Telephony Manager 0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya CallPilot 0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Conferencing 6.0 SP1 Standard
Not Vulnerable:

Microsoft Remote Desktop ActiveX Control CVE-2013-1296 Remote Code Execution Vulnerability

The Microsoft Remote Desktop ActiveX control is prone to a remote code-execution vulnerability.

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage.

Successful exploits will allow the attacker to execute arbitrary code within the context of the application (typically Internet Explorer) that uses the ActiveX control.

Microsoft Remote Desktop ActiveX Control CVE-2013-1296 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Remote Desktop ActiveX Control CVE-2013-1296 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft RDP 7.0

• Microsoft Security Update for Windows 7 (KB2813347)
  http://www.microsoft.com/downloads/details.aspx?familyid=d7623f17-783d -431a-8274-17d71df72202


• Microsoft Security Update for Windows 7 for x64-based Systems (KB2813347)
  http://www.microsoft.com/downloads/details.aspx?familyid=5595efaa-3d57 -4c9a-8b53-7cfa06093f1e


• Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2813347)
  http://www.microsoft.com/downloads/details.aspx?familyid=c7047403-8c2a -42de-bea5-d7354847730a


• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2813347)
  http://www.microsoft.com/downloads/details.aspx?familyid=79c870b9-b800 -4f59-a5ea-19a5c890af52


• Microsoft Security Update for Windows Vista (KB2813347)
  http://www.microsoft.com/downloads/details.aspx?familyid=1bf2935a-2fa4 -4a26-bccf-fe0b63a16b37


• Microsoft Security Update for Windows Vista for x64-based Systems (KB2813347)
  http://www.microsoft.com/downloads/details.aspx?familyid=201eb194-e7c9 -479c-bb03-646b22f2bbd1


• Microsoft Security Update for Windows XP (KB2813347)
  http://www.microsoft.com/downloads/details.aspx?familyid=1754fdde-4744 -4783-b6d3-e38eb2874b58

Microsoft RDP 6.1

• Microsoft Security Update for Windows Server 2003 (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=75b00750-80c3 -4ffa-adbf-5f40a41309b9


• Microsoft Security Update for Windows Server 2003 x64 Edition (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=7efb8816-ca23 -4a75-a0cc-53a663eac3a9


• Microsoft Security Update for Windows Server 2008 (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=92bd1819-46f9 -4a9b-bf2b-ea6aaaee9890


• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=4807c3fe-bc54 -4db6-a9b0-ee21bdd9820f


• Microsoft Security Update for Windows Server 2008 x64 Edition (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=6518cdc6-10a6 -46ed-a2f6-6f58216fe319


• Microsoft Security Update for Windows Vista (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=20500712-2c0f -41e2-95a8-db1a5dcf717a


• Microsoft Security Update for Windows Vista for x64-based Systems (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=4c6f006c-fcb8 -499f-bd91-9c8acb3ec3c3


• Microsoft Security Update for Windows XP (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=353812de-b1eb -4245-82e3-7829cb72bba3


• Microsoft Security Update for Windows XP x64 Edition (KB2813345)
  http://www.microsoft.com/downloads/details.aspx?familyid=f413845a-84e0 -48d9-b5bc-56a37109ab33

Microsoft Remote Desktop ActiveX Control CVE-2013-1296 Remote Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• MS12-027: Enhanced protections regarding ActiveX controls in Microsoft Office do (Microsoft)