Security threats Toolkit

XP flaw allows for DoS attacks

Tags:
Windows,
Remote Desktop Service,
SP2

Joris Evers CNET News

Published: 18 Jul 2005 09:15 BST

A newly discovered and as-of-yet unpatched security vulnerability in Windows XP could let an attacker remotely crash computers.

The flaw affects the Windows Remote Desktop Service, which lets users access their Windows PC from a remote location. An attacker could remotely exploit the problem to crash a victim's PC, according to a posting on the Security Protocols Web site earlier this week. The user would then see the Windows Blue Screen of Death.

Microsoft knows of the security flaw and is working on a patch, a company representative said on Friday.

"The issue was originally privately reported to Microsoft and we are working on an update that will be released when it is of the appropriate quality," the representative said. "The concern is that this has now gone public, potentially putting customers at risk."

According to the Security Protocols Web site, Microsoft was informed of the problem on 4 May and plans to release a patch as part of its August update cycle. Fully patched Windows XP machines — including those with the Service Pack 2 update and the firewall enabled — are vulnerable, according to Security Protocols.

In its initial review of the bug, Microsoft found that an attacker would not be able to run code on the victim's PC, but the attacker could cause the computer to stop responding, the representative said. Also, only computers that have the Remote Desktop Service enabled are vulnerable, she said. Windows ships with the service disabled, according to Microsoft.

Security researchers at iDefense are also looking into the vulnerability. "It does not look like it is more than a DoS," said Michael Sutton, a lab director at iDefense. "An attacker won't be able to take over your PC, but could knock it offline."

Security monitoring company Secunia rates the vulnerability "moderately critical", it said in an advisory issued on Thursday.

Microsoft said it is not aware of attacks that try to use the new vulnerability.

Reports of the new Windows flaw come in the same week that Microsoft patched two "critical" Windows vulnerabilities. Both those Windows flaws are actively being exploited by attackers, the Redmond, Washington, software giant said on Tuesday.