Solved

Windows Remote Desktop Protocol Private Key Disclosure

Posted on 2009-05-13
5
1,107 Views
Last Modified: 2012-05-06
Hi Experts:

Our security scan shows us that we have a vunerbility called "Windows Remote Desktop Protocol Private Key Disclosure". I have searched all over the internet but can't seem to find a solution.
Could someone what I need to do to fix this?
We are running Windows server 2003 R2 with SP2.
Thanks
0
Comment
Question by:changjia
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 12

Expert Comment

by:nsx106052
ID: 24378095
This article is pretty good on the issue you are seeing:
http://www.vulnerabilityscanning.com/Microsoft-Windows-Remote-Desktop-Protocol-Server-P-Test_18405.htm

Another thing to consider may be to create local firewall policies to only allow RDP traffic from the local subnet.  Also check to make sure the computer is up to date with all the latest MS security patches.
0
 

Author Comment

by:changjia
ID: 24378264
Hi Nsx106052,

From reading the article, I have learn that the solution is to Force the use of SSL as a transport layer for this service.

Do you know how to do that?

Thanks
0
 
LVL 12

Expert Comment

by:nsx106052
ID: 24378379
You will need to configure it in Group policy:

computer configuration/administrative templates/windows components/terminal services/encryption and security



0
 

Author Comment

by:changjia
ID: 24378688
It has always been set to high and require secure connection, how come the scan still shows the vunerbility?
Thanks
0
 
LVL 27

Accepted Solution

by:
Tolomir earned 500 total points
ID: 24603401
Well the problem still persists but you can circumvent it:

---
http://social.msdn.microsoft.com/forums/en-US/winserver2008appcompatabilityandcertification/thread/de9ad6db-f814-4f44-bd64-ddcf9173ab74/

This issue was "fixed" by adding SSL support to TS in W2K3 SP1 and CredSSP to Vista/W2K8.

In W2K3 this was:

BUG: 806509 - APPROVED DCR: ETA: 8/6 WS2003SP1: RDP is vulnerable to man-in-the-middle attack

It was a well-known TS security issue. The private key used to sign a proprietary certificate (which contains the generated TS public key) is hardcoded in the code (see MS-RDPBCGR section 5.3.3 for more details).

Take a look at (this discuss SSL in W2K3 SP1):

http://technet2.microsoft.com/WindowsServer/en/library/a92d8eb9-f53d-4e86-ac9b-29fd6146977b1033.mspx?mfr=true

---

So with SSL enabled this is no longer an issue. When you disable SSL it is an issue, so it is not repaired.

Tolomir
0

Featured Post

Now Available: Firebox Cloud for AWS and FireboxV

Firebox Cloud brings the protection of WatchGuard’s leading Firebox UTM appliances to public cloud environments. It enables organizations to extend their security perimeter to protect business-critical assets in Amazon Web Services (AWS).

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
CDC and AOG on MS SQL 2012 13 38
Windows 10 Task Scheduler fears and concerns 8 45
Rogue RDP Connections 5 58
80072efd error while checking for updates. 20 49
The related questions "How do I recover the passwords for my Q-See DVR" and "How can I reset my Q-See DVR to eliminate a password" are seen several times a week.  Here we discuss the grim reality of the situation.
Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question