MS.Windows.RDP.ESTEEMAUDIT.Code.Execution

Description

This indicates an attack attempt to exploit a remote Code Execution vulnerability in Microsoft Windows that was disclosed by Shadow Broker as ESTEEMAUDIT exploit.
The vulnerability is caused by an error when the RDP service handles a malicious request. A remote attacker may be able to exploit this to gain control of vulnerable systems via a crafted client request.

Affected Products

Windows XP
Windows XP SP1
Windows XP SP2
Windows XP SP3
Windows 2003
Windows 2003 SP1
Windows 2003 SP2

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Upgrade to the latest version available from the website.
https://support.microsoft.com/en-ca/help/4022747/security-update-for-windows-xp-and-windows-server-2003

References