Signature Detail

APP: Microsoft Remote Desktop Protocol Connection

This signature detects Microsoft Remote Desktop (RDP) traffic. RDP is a remote administration tool. Anomalous RDP traffic can indicate that the host is compromised.

Extended Description

Microsoft Windows Korean Input Method Editor is prone to a local privilege-escalation vulnerability. Successful exploitation can allow local attackers to completely compromise a vulnerable computer.

Affected Products

• Microsoft office_2003 SP1
• Microsoft office_2003 SP2
• Microsoft office_2003
• Microsoft windows_server_2003_datacenter_edition SP1
• Microsoft windows_server_2003_datacenter_edition
• Microsoft windows_server_2003_datacenter_edition_itanium SP1
• Microsoft windows_server_2003_datacenter_edition_itanium
• Microsoft windows_server_2003_datacenter_x64_edition
• Microsoft windows_server_2003_enterprise_edition SP1
• Microsoft windows_server_2003_enterprise_edition
• Microsoft windows_server_2003_enterprise_edition_itanium SP1
• Microsoft windows_server_2003_enterprise_edition_itanium
• Microsoft windows_server_2003_enterprise_x64_edition
• Microsoft windows_server_2003_standard_edition SP1
• Microsoft windows_server_2003_standard_edition
• Microsoft windows_server_2003_standard_x64_edition
• Microsoft windows_server_2003_web_edition SP1
• Microsoft windows_server_2003_web_edition
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home SP2
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition SP2
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional SP2
• Microsoft windows_xp_professional
• Microsoft windows_xp_professional_x64_edition
• Microsoft windows_xp_tablet_pc_edition SP1
• Microsoft windows_xp_tablet_pc_edition SP2
• Microsoft windows_xp_tablet_pc_edition

References

• BugTraq: 16643
• CVE: CVE-2006-0008
• URL: http://www.microsoft.com/windowsxp/downloads/tools/rdclientdl.mspx
• URL: http://www.microsoft.com/technet/security/bulletin/MS06-009.mspx