Windows Remote Desktop Protocol Private Key Disclosure

Hi Experts:

Our security scan shows us that we have a vunerbility called "Windows Remote Desktop Protocol Private Key Disclosure". I have searched all over the internet but can't seem to find a solution.
Could someone what I need to do to fix this?
We are running Windows server 2003 R2 with SP2.
Thanks
changjiaAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
TolomirConnect With a Mentor AdministratorCommented:
Well the problem still persists but you can circumvent it:

---
http://social.msdn.microsoft.com/forums/en-US/winserver2008appcompatabilityandcertification/thread/de9ad6db-f814-4f44-bd64-ddcf9173ab74/

This issue was "fixed" by adding SSL support to TS in W2K3 SP1 and CredSSP to Vista/W2K8.

In W2K3 this was:

BUG: 806509 - APPROVED DCR: ETA: 8/6 WS2003SP1: RDP is vulnerable to man-in-the-middle attack

It was a well-known TS security issue. The private key used to sign a proprietary certificate (which contains the generated TS public key) is hardcoded in the code (see MS-RDPBCGR section 5.3.3 for more details).

Take a look at (this discuss SSL in W2K3 SP1):

http://technet2.microsoft.com/WindowsServer/en/library/a92d8eb9-f53d-4e86-ac9b-29fd6146977b1033.mspx?mfr=true

---

So with SSL enabled this is no longer an issue. When you disable SSL it is an issue, so it is not repaired.

Tolomir
0
 
nsx106052Commented:
This article is pretty good on the issue you are seeing:
http://www.vulnerabilityscanning.com/Microsoft-Windows-Remote-Desktop-Protocol-Server-P-Test_18405.htm

Another thing to consider may be to create local firewall policies to only allow RDP traffic from the local subnet.  Also check to make sure the computer is up to date with all the latest MS security patches.
0
 
changjiaAuthor Commented:
Hi Nsx106052,

From reading the article, I have learn that the solution is to Force the use of SSL as a transport layer for this service.

Do you know how to do that?

Thanks
0
 
nsx106052Commented:
You will need to configure it in Group policy:

computer configuration/administrative templates/windows components/terminal services/encryption and security



0
 
changjiaAuthor Commented:
It has always been set to high and require secure connection, how come the scan still shows the vunerbility?
Thanks
0
All Courses

From novice to tech pro — start learning today.