Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness

This script is Copyright (C) 2005-2016 Tenable Network Security, Inc.


Synopsis :

It may be possible to get access to the remote host.

Description :

The remote version of the Remote Desktop Protocol Server (Terminal
Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP
client makes no effort to validate the identity of the server when
setting up encryption. An attacker with the ability to intercept
traffic from the RDP server can establish encryption with the client
and server without being detected. A MiTM attack of this nature would
allow the attacker to obtain any sensitive information transmitted,
including authentication credentials.

This flaw exists because the RDP server stores a hard-coded RSA
private key in the mstlsapi.dll library. Any local user with
access to this file (on any Windows system) can retrieve the
key and use it for this attack.

See also :

http://www.oxid.it/downloads/rdp-gbu.pdf
http://www.nessus.org/u?e2628096
http://technet.microsoft.com/en-us/library/cc782610.aspx

Solution :

- Force the use of SSL as a transport layer for this service if
supported, or/and

- Select the 'Allow connections only from computers running Remote
Desktop with Network Level Authentication' setting if it is available.

Risk factor :

Medium / CVSS Base Score : 5.1
(CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 4.6
(CVSS2#E:F/RL:W/RC:ND)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 18405 ()

Bugtraq ID: 13818

CVE ID: CVE-2005-1794

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now