To exploit the vulnerability, an attacker could create an RDG file containing specially crafted XML content and convince an authenticated user to open the file. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.
You may need to install this on Windows Server 2012 R2, Windows Server 2016, and some versions of Windows 10. Here's how Microsoft described the vulnerability:Īn information disclosure vulnerability exists in the Remote Desktop Connection Manager (RDCMan) application when it improperly parses XML input containing a reference to an external entity. Download the Remote Desktop client installer, choosing the correct version for your device: Windows 64-bit (most common) Windows 32-bit Windows on Arm. The vulnerability was assigned the ID CVE-2020-0765 and the latest RDCMan v2.82 addresses the issue. To set up a new remote connection on Windows 11, use these steps: Open the Remote Desktop app. Mark Russinovich, CTO of Microsoft Azure and co-creator of the Sysinternals utility suite, confirmed that RDCMan wouldn't be abandoned and it will now be a part of Sysinternals.Įarlier today, Microsoft also updated its CVE for the security issue found in RDCMan, stating that the problem has been fixed. However, earlier this year in February, it had a change of heart. Back in March last year, Microsoft said it will deprecate its Remote Desktop Connection Manager (RDCMan) after a security vulnerability was found in the software.
0 kommentar(er)
