| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Microsoft Security Bulletin MS02-151: Cryptographic Flaw in RDP Protocol can Lead to Information Disclosure (Q324380) | |
|
||
| Time: 08:05 EST/13:05 GMT | News Source: ActiveWin.com | Posted By: Todd Richardson | ||
|
The first involves how session encryption is implemented in certain versions of RDP. All RDP implementations allow the data in an RDP session to be encrypted. However, in the versions in Windows 2000 and Windows XP, the checksums of the plaintext session data are sent without being encrypted themselves. An attacker who was able to eavesdrop on and record an RDP session could conduct a straightforward cryptanalytic attack against the checksums and recover the session traffic.
The second involves how the RDP implementation in Windows XP handles data packets that are malformed in a particular way. Upon receiving such packets, the Remote Desktop service would fail, and with it would fail the operating system. It would not be necessary for an attacker to authenticate to an affected system in order to deliver packets of this type to an affected system.
| ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 307 Last | Next |
The time now is
1:43:23 PM
ET.
Any comment problems? E-mail us |
| #1 By 478 (65.101.164.228) at 9/19/2002 10:47:23 AM |
|
This patch is OLD for XP
A newer one is already included in SP1 I expected better from your staff. This post was edited by recreagh on Thursday, September 19, 2002 at 10:53. |
| #2 By 665 (66.49.20.2) at 9/19/2002 1:15:26 PM |
| #1, I'm glad you expect a lot from us, because we always try very hard. Your right, this patch is not necessary for Windows XP SP1 users, however, for uses that have not updated their XP systems yet to SP1 for whatever reason should apply this fix. Also, users who are using Windows 2000 should apply this fix, as they obviously wouldn't have installed Windows XP SP1. |
| #3 By 2062 (68.129.23.73) at 9/19/2002 2:10:57 PM |
|
I like how the guy that found this flaw told microsoft about it 5 months ago and ms did not issue a fix (other than sp1). He complains this week and this article is made, and he gets no credit for finding the hole. How rude is that?
-gosh |
| #4 By 1845 (12.254.162.111) at 9/19/2002 4:15:18 PM |
| Turn the other cheek, Realist. If someone hasn't upgraded to SP1, there is a good chance they don't care about this little fix. |
| #5 By 135 (208.50.201.48) at 9/19/2002 11:00:06 PM |
|
beeyp - Hey now, I'm not anti-Linux or anti-Open Source.
I'm just anti-stupidity. Good troll in #4, BTW. You would fit in well over at /. |
| #6 By 1845 (12.254.162.111) at 9/19/2002 11:28:00 PM |
| Blue, he is just trying to shake things up. ;) |
|
Write Comment
Return to News |
Displaying 1 through 25 of 307 Last | Next |
The time now is
1:43:23 PM
ET.
Any comment problems? E-mail us |
