PT-2024-5638 · Microsoft · Windows+1

Mas0N · Published 2024-08-13 · Updated 2025-03-15 · CVE-2024-38131

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Remote Desktop Client versions prior to 1.2.5620

Description The vulnerability is related to the Clipboard Virtual Channel Extension in Windows operating systems, which uses insecure mechanisms for handling authentication data in the operating system's memory. This allows a remote attacker to execute arbitrary code. The issue can be exploited by remote attackers to affect the system.

Recommendations Update the Microsoft Remote Desktop Client to at least version 1.2.5620 to fix the vulnerability. As a temporary workaround, consider restricting access to the Clipboard Virtual Channel Extension until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-591

Related Identifiers

BDU:2024-06351

CVE-2024-38131

Affected Products

Remote Desktop Client

Windows

References · 16

• https://safe-surf.ru/specialists/bulletins-nkcki/711005 · Security Note
• https://bdu.fstec.ru/vul/2024-06351 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38131 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38131 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38131 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38131 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38131 · Vendor Advisory
• https://twitter.com/cstalhood/status/1824033931928150464 · Twitter Post
• https://twitter.com/johnbillekens/status/1828042497727049997 · Twitter Post
• https://twitter.com/CveFindCom/status/1823495392979292500 · Twitter Post
• https://twitter.com/andresbohren/status/1826694628340330807 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1900825767342112786 · Twitter Post
• https://twitter.com/andresbohren/status/1823989957846761595 · Twitter Post
• https://twitter.com/pvdnborn/status/1828043093481820362 · Twitter Post
• https://t.me/cvenotify/90924 · Telegram Post