Intrusion PreventionMS.Windows.Remote.Desktop.Dll.Hijacking
Description
This indicates an attack attempt against a DLL Hijacking vulnerability in Microsoft Remote Desktop.
The vulnerability exists because of the way that Windows Remote Desktop handles the loading of DLL files. An attacker who successfully exploits this vulnerability could take complete control of an affected system.
Affected Products
Remote Desktop Connection 5.2 Client
+Windows XP Service Pack 3
Remote Desktop Connection 6.0 Client and Remote Desktop Connection 6.1 Client
+Windows XP Service Pack 3
+Windows XP Professional x64 Edition Service Pack 2
+Windows Server 2003 Service Pack 2
+Windows Server 2003 Service Pack 2
+Windows Server 2003 x64 Edition Service Pack 2
+Windows Vista Service Pack 1 and Windows Vista Service Pack 2
+Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
+Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
+Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
+Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Remote Desktop Connection 7.0 Client
+Windows XP Service Pack 3
+Windows Vista Service Pack 1 and Windows Vista Service Pack 2
+Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
+Windows 7 for 32-bit Systems
+Windows 7 for x64-based Systems
+Windows Server 2008 R2 for x64-based Systems
+Windows Server 2008 R2 for Itanium-based Systems
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the latest update from the vendor.
Remote Desktop Connection 5.2 Client
+Windows XP Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=1AED6080-FEAB-4B5E-9D26-6A3F4B92434D
Remote Desktop Connection 6.0 Client and Remote Desktop Connection 6.1 Client
+Windows XP Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=D67E4D8C-AEB9-45E6-9555-7456C5540475
+Windows XP Professional x64 Edition Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=6D4539EF-4A05-4C7D-9489-436F7B7A3EBE
+Windows Server 2003 Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=641D5D12-0790-4551-831A-E78FEBAD17A7
+Windows Server 2003 Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=6FEC0D06-042D-4E55-9843-009EDD7D26CE
+Windows Server 2003 x64 Edition Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=78DBB9CF-8A18-4F0A-8EDF-F1CE0C993C63
+Windows Vista Service Pack 1 and Windows Vista Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=E3EA7690-386B-4CDF-889F-B3914921C56F
+Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=5735BED6-0E3D-46A4-85D0-14EC34A82EDD
+Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=31D790C9-92F9-4A2B-800B-8E8D2B570BB9
+Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=5B0A8EB5-4BC2-4054-B952-58AA645AFCF5
+Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=25DA7E00-745D-4D98-9DD8-52A8A4340404
Remote Desktop Connection 7.0 Client
+Windows XP Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=6A01992E-C9A1-4DC9-A3EF-7410B81F17E6
+Windows Vista Service Pack 1 and Windows Vista Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=3C30F67E-7C31-4553-BA3E-E056DF1BF8EB
+Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=8025482B-F58F-4F5A-A133-5563C65B21F6
+Windows 7 for 32-bit Systems
http://www.microsoft.com/downloads/details.aspx?familyid=0768A5F4-DA28-4B2E-8AFF-D68F890DF3E6
+Windows 7 for x64-based Systems
http://www.microsoft.com/downloads/details.aspx?familyid=935ADB10-1E7E-4501-B543-8247B88F6D18
+Windows Server 2008 R2 for x64-based Systems
http://www.microsoft.com/downloads/details.aspx?familyid=3FCB2E11-591E-484A-A992-2F1D563E6D17
+Windows Server 2008 R2 for Itanium-based Systems
http://www.microsoft.com/downloads/details.aspx?familyid=C29B6487-78F0-421C-810C-C5E45D6A2352
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 29273 |
| Created | Sep 23, 2011 |
| Updated | Mar 17, 2021 |
| Risk |
|
| CVE ID | CVE-2011-0029 |
| Exploit Prediction Score | 96.12% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |