PT-2011-2026 · Microsoft · Remote Desktop Connection

Eyal Gruner · Published 2011-03-09 · Updated 2024-10-17 · CVE-2011-0029

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Remote Desktop Connection versions 5.2 through 7.0

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. This can be demonstrated by a directory that contains a .rdp file. The vulnerability is related to an untrusted search path in the client.

Recommendations For Microsoft Remote Desktop Connection versions 5.2 through 7.0, consider restricting the use of the current working directory to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using directories that contain .rdp files.

Fix

Related Identifiers

CVE-2011-0029

Affected Products

Remote Desktop Connection

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2011-0029 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-017 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA11-067A.html · Note
• http://vupen.com/english/advisories/2011/0616 · Note
• http://securitytracker.com/id?1025172 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12480 · Note
• http://secunia.com/advisories/43628 · Note
• http://osvdb.org/71014 · Note
• https://t.me/cvenotify/98684 · Telegram Post