Experts sound worm alarm for critical Windows bug

Microsoft patches Remote Desktop Protocol flaw, urges customers to apply update or workaround ASAP

Microsoft today released six security updates that patched seven vulnerabilities, including a critical Windows bug that hackers will certainly try to exploit with a network worm, according to researchers.

"This is a pre-authentication, remote code bug," said Andrew Storms, director of security operations at nCircle Security, referring to MS12-020, the one critical bulletin today and the update that he, other researchers and even Microsoft urged users to patch as soon as possible.

"It will allow network execution without any authentication, and has all the ingredients for a class worm," said Storms.

"I'm particular spooked by this one," said Jason Miller, manager of research and development at VMware. "Hackers want [vulnerabilities] that don't require authentication and are in a part of Windows that's widely used. I guarantee that attackers are going to look at this closely."

MS12-020 patches a pair of bugs in Windows' Remote Desktop Protocol (RDP), a component that lets users remotely access a PC or server. RDP is frequently used by corporate help desks, off-site users and IT administrators to manage servers at company data centers and those the enterprise farms out to cloud-based service providers like Amazon and Microsoft.

The critical vulnerability, dubbed CVE-2012-0002, could be exploited by an attacker who simply sends specially-crafted data packets to a system with RDP enabled, said Microsoft.

"Absolutely, this will be very attractive to hackers," said Amol Sarwate, manager of Qualys' vulnerability research lab, echoing Storms and Miller. "It doesn't look like it's that complicated to come up with the code sequence [to trigger the bug]."

Microsoft raised all its usual flags, and more, for MS12-020, tagging it with an exploitability index rating of "1," meaning it expects reliable exploits to appear within 30 days, and ranking the update as the one to patch before all others.

In a post to the company's Security Research & Defense (SRD) blog, Suha Can and Jonathan Ness, a pair of Microsoft engineers, went even further. "[We] strongly encourage you to make a special priority of applying this particular update," said Can and Ness.

Ideally, customers will quickly apply the patch, but Microsoft also offered a temporary workaround.

The workaround, which Microsoft automated using its Fix-it support tool, adds another layer of security by requiring Network Level Authentication, or NLA, to force authentication before an RDP session begins. The Fix-it tool applies to Windows Vista, Windows 7, Server 2008 and Server 2008 R2.

Windows XP and Server 2003, however, do not support NLA; for the former, Microsoft's released an additional Fix-it tool that adds NLA support to Windows XP Service Pack 3 (SP3) desktops and laptops.

Links to the Fix-it tools can be found on the SRD blog.

Several researchers applauded Microsoft's workarounds, in large part because unlike the patch, they don't require a system reboot, which may make server administrators skittish about applying MS12-020 itself.

"NLA a really good option," said Wolfgang Kandek, chief technology officer at Qualys. He and others expect that many Microsoft customers will enable NLA first, then later patch the vulnerability by deploying MS12-020.

"It's going to be enough to mitigate the first wave of attacks," argued Storms, of enabling NLA.

Storms and Miller agreed that that first wave will be, as Miller put it, a "scattershot" style attack where hackers use search engines and port sniffing to find as many RDP-enabled machines as possible. Later, targeted attacks aimed at administrators' PCs -- which they use to remotely manage their companies' data servers -- or those launched from bots already inside a network, seem likely.

Microsoft downplayed the threat to some degree, saying both in the MS12-020 bulletin and in the SRD blog that RDP was not turned on by default in any supported version of Windows.

Miller thought that was misleading. "I'm a little concerned that Microsoft is implying that RDP is not commonly used," said Miller. "It's used by server administrators and help desks.... It's a really good technology ... and enabled on a lot of corporate networks."

Storms pitched in as well.

"RDP is the way to remotely manage your servers," said Storms. "Let's be honest, it's enabled more often than not, and [switched on] on virtually every server."

"It's unfair to say it's not really widely used," added Miller. "I use it to connect to 40 to 50 machines a day in my job."

Because of what the experts said was the wide use of RDP, they thought Microsoft underplayed the severity of the vulnerability. "They're making a call to action, but without raising too many red flags," said Storms. "They're trying to get across [that this is significant] without saying it's doomsday."

Kandek wished Microsoft had a deployment priority higher than "1," the ranking the company assigned MS12-020. "This is more a '1+,'" Kandek said.

The biggest unknown is how fast hackers will figure out how to exploit the vulnerability, and thus how quickly Windows users will face attacks.

Kandek, Miller, Storms and Sarwate couldn't agree on a timeline, but all thought that active exploits would be in circulation quickly.

And even if they're not, there have been threats that wreaked havoc weeks or months after a Microsoft patch.

"I don't want to compare this to Conficker," said Miller, talking about the worm that infected millions of Windows PCs in late 2008 and early 2009. "But that did its worst 30 days, 60 days after the patch [of the exploited bug]."

Miller had a point: Although Conficker first appeared just 11 days after an October 2008 emergency, or "out-of-cycle" update, it only gained traction in January 2009, and peaked with a media frenzy three months after that.

Microsoft also released three other updates for Windows, and one each for Visual Studio and Expression Design, but the experts said they were small potatoes compared to MS12-020.

"It's all about RDP today," said Storms. "Either enable NLA or install the patch ... today."

March's six security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , on Google+ or subscribe to Gregg's RSS feed . His email address is .

See more by Gregg Keizer on .

Read more about security in Computerworld's Security Topic Center.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?