Microsoft today released details and a patch for the MS12-020 vulnerability. This is a remotely exploitable vulnerability in most current Windows platforms that are running Terminal Server/RDP. Many organizations use this service remotely across the Internet, via a VPN, or locally for internal tasks. It is a common, prevalent technology, and thus the target pool for attacks is likely to make this a significant issue in the near future.
Please identify your exposures to this vulnerability. Exploits are likely currently being developed. We have not yet (3/13/12 – 2.15pm Eastern) seen exploitation or an increase in probes for port 3389, but both are expected to occur shortly.
Please let us know if you have any questions or if we may be of any assistance with this issue.
UPDATE:
This article makes reference to a potential worm attack vector, which we see as increasingly likely. Our team believes the exploitation development time to be significantly less than 30 days and more like 1-3 days for resourced attackers. As such, PLEASE TREAT THIS AS A SIGNIFICANT INTERNAL VULNERABILITY as well. Certainly, IMMEDIATE consideration is needed for Internet exposed systems, but INTERNAL systems should be patched as soon as manageable as well.
UPDATE II:
This confirms the scope and criticality of this issue.
UPDATE III:
Just a quick note – we are seeing vast work on the MS12-020 exploit. Some evidence points to 2 working versions. Not public, yet, but PATCH NOW. Internal & protected networks too.
UPDATE IV:
MSI is proud to announce the immediate availability of a FREE version of HoneyPoint, called HPRDP2012 to help organizations monitor for ongoing scans and potential future worm activity. The application listens on port 3389/TCP and is available for OS X (Intel), Windows & Linux. This application is similar to our releases for Conficker & Morto, in that it will be operational for a set time (specifically until October 1, 2012). Simply unzip the application to where you would like to run and execute it. We hope this helps organizations manage this vulnerability and detect impacts should scans, probes or a worm emerge. Traditional HoneyPoint customers can use Agent and/or Wasp to listen for these connections and report them centrally by dilating TCP listener HoneyPoints on port 3389. Please let us know if you have any questions.
Threat and Vulnerability: Pay Attention to MS12-020 http://t.co/ZN6RdbjS
RT @MicroSolved: SECURITY ALERT: Threat and Vulnerability: Pay Attention to MS12-020 http://t.co/fjmPoPJV #security #in
Updates to the MS12-020 critical alert. Don’t forget to patch if you’ve not done so already! http://t.co/uYlOpVNq #security #in
Very cool! The hive has been busy! FREE HoneyPoint version offered with NEW update to MS12-020 blog post! http://t.co/uYlOpVNq #security #in
RT @ITworld: Threat and Vulnerability: Pay Attention to MS12-020 http://t.co/wYBSYHHY Download FREE version of HoneyPoint to monitor scans of network