Patch Now: Microsoft RDP Exploit Code Is in the Wild

When Microsoft released its March 2012 Patch Tuesday security bulletins last week, security experts were unanimous that MS12-020 needed to be patched urgently. A few days later, the threat got even more real when proof-of-concept (PoC) exploit code was discovered online. Patching MS12-020 is no longer just urgent, it’s imperative.

The MS12-020 security bulletin addresses flaws in Microsoft RDP (Remote Desktop Protocol) that could be used in remote attacks. Because RDP generally doesn’t require additional network credentials, and it’s typically used by IT admins as a way to remotely manage servers the vulnerabilities pose an even greater risk.

Andrew Storms, Director of Security Operations for nCircle, stressed, “Patch this one immediately, if not sooner.”

Security experts were concerned that attackers would quickly develop an exploit–possibly even a worm reminiscent of threats from the Golden Age of malware like Nimda and SQL Slammer. Exploit code appeared much quicker than anticipated, though, when PoC code was discovered online. It is being speculated that the exploit code was developed internally at Microsoft to test the vulnerability, and may have been leaked from Microsoft’s MAPP (Microsoft Active Protection Program).

A blog post from Symantec on Friday confirmed that the PoC exploit code was discovered in the wild. It emphasized the fact that the PoC code does not deliver a payload, but cautioned that with the PoC code in hand attackers could find a way to weaponize and spread the attack much more quickly.

Lamar Bailey, Director of Security Research and Development for nCircle, warned that exploits with malicious payloads may only take a day or two to develop, and that within a week we could see multiple malicious payloads. He also believes that it’s inevitable that we will see a worm developed to exploit the RDP flaws.

Bailey says, “This is a serious threat to enterprise security because most firewalls are open to RDP to allow access to multiple systems. Patch it now or pay later. This should be at the top of every enterprise security teams list every day until their entire network is completely patched.”

I know it seems a bit melodramatic, and it’s easy to dismiss security experts claiming the “sky is falling”. But, when SQL Slammer wormed its way around the world and crippled the Internet in under an hour, it exploited a flaw that Microsoft had published a patch for many months earlier. Don’t let MS12-020 become another SQL Slammer. Patch it now.