Intrusion Prevention

MS.Windows.RDP.Channel.MS_T120.Remote.Code.Execution

Description

This indicates a possible attack against a Remote Code Execution vulnerability in Microsoft Remote Desktop.
The vulnerability is caused by an error when the RDP service handles a malicious request. A remote attacker may be able to exploit this to gain control of vulnerable systems via a crafted client request.

Affected Products

Microsoft Windows XP
Microsoft Windows Server 2008 R2 for x64-based Systems SP1
Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
Microsoft Windows Server 2008 for x64-based Systems SP2
Microsoft Windows Server 2008 for Itanium-based Systems SP2
Microsoft Windows Server 2008 for 32-bit Systems SP2
Microsoft Windows Server 2003
Microsoft Windows 7 for x64-based Systems SP1
Microsoft Windows 7 for 32-bit Systems SP1

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Upgrade to the latest version available from the website.
https://support.microsoft.com/en-ca/help/4500331/windows-update-kb4500331

CVE References

CVE-2019-0708