Signature Detail

APP: Microsoft Remote Desktop Protocol Connection

This signature detects Microsoft Remote Desktop (RDP) traffic. RDP is a remote administration tool. Anomalous RDP traffic can indicate that the host is compromised.

Extended Description

Microsoft Windows Korean Input Method Editor is prone to a local privilege-escalation vulnerability. Successful exploitation can allow local attackers to completely compromise a vulnerable computer.

Affected Products

• Microsoft Office 2003 SP1
• Microsoft Office 2003 SP2
• Microsoft Office 2003
• Microsoft Windows Server 2003 Datacenter Edition SP1
• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
• Microsoft Windows Server 2003 Datacenter Edition Itanium
• Microsoft Windows Server 2003 Datacenter x64 Edition
• Microsoft Windows Server 2003 Enterprise Edition SP1
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
• Microsoft Windows Server 2003 Enterprise Edition Itanium
• Microsoft Windows Server 2003 Enterprise x64 Edition
• Microsoft Windows Server 2003 Standard Edition SP1
• Microsoft Windows Server 2003 Standard Edition
• Microsoft Windows Server 2003 Standard x64 Edition
• Microsoft Windows Server 2003 Web Edition SP1
• Microsoft Windows Server 2003 Web Edition
• Microsoft Windows XP Home SP1
• Microsoft Windows XP Home SP2
• Microsoft Windows XP Home
• Microsoft Windows XP Media Center Edition SP1
• Microsoft Windows XP Media Center Edition SP2
• Microsoft Windows XP Media Center Edition
• Microsoft Windows XP Professional SP1
• Microsoft Windows XP Professional SP2
• Microsoft Windows XP Professional
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows XP Tablet PC Edition SP1
• Microsoft Windows XP Tablet PC Edition SP2
• Microsoft Windows XP Tablet PC Edition

References

• BugTraq: 16643
• CVE: CVE-2006-0008
• URL: http://www.microsoft.com/windowsxp/downloads/tools/rdclientdl.mspx
• URL: http://www.microsoft.com/technet/security/bulletin/MS06-009.mspx