Vulnerabilities > CVE-2013-1296 - Code Injection vulnerability in Microsoft Remote Desktop Connection 6.1/7.0
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a web page that triggers access to a deleted object, and allows remote RDP servers to execute arbitrary code via unspecified vectors that trigger access to a deleted object, aka "RDP ActiveX Control Remote Code Execution Vulnerability."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Msbulletin
| bulletin_id | MS13-029 |
| bulletin_url | |
| date | 2013-04-09T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 2828223 |
| knowledgebase_url | |
| severity | Critical |
| title | Vulnerability in Remote Desktop Client Could Allow Remote Code Execution |
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS13-029.NASL |
| description | The remote host contains a version of the Remote Desktop ActiveX control that is affected by a remote code execution vulnerability when attempting to access an object in memory that has been deleted. If an attacker can trick a user on the affected system into opening a specially crafted webpage, this issue could be leveraged to execute arbitrary code subject to the user |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 65876 |
| published | 2013-04-10 |
| reporter | This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/65876 |
| title | MS13-029: Vulnerability in Remote Desktop Client Could Allow Remote Code Execution (2828223) |
| code | |
Oval
| accepted | 2015-02-23T04:00:43.534-05:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description | The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a web page that triggers access to a deleted object, and allows remote RDP servers to execute arbitrary code via unspecified vectors that trigger access to a deleted object, aka "RDP ActiveX Control Remote Code Execution Vulnerability." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:16598 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| submitted | 2013-04-12T09:57:48 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| title | Microsoft Windows Remote Desktop Client remote code execution vulnerability - MS13-029 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version | 80 |
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 58874 CVE(CAN) ID: CVE-2013-1296 远程桌面协议（RDP, Remote Desktop Protocol）是一个多通道（multi-channel）的协议，让用户（客户端或称“本地电脑”）连上提供微软终端机服务的电脑（服务器端或称“远程电脑”）。 当远程桌面 ActiveX 控件 mstscax.dll 尝试访问内存中已被删除的对象时，存在一个远程执行代码漏洞。攻击者可通过诱使用户访问特制网页来利用该漏洞。成功利用此漏洞的攻击者可以获得与登录用户相同的用户权限。 0 Microsoft Windows XP Microsoft Windows Server 2008 Microsoft Windows Server 2003 Microsoft Windows 7 临时解决方法： 如果您不能立刻安装补丁或者升级，建议您采取以下措施以降低威胁： * 限制对 mstscax.dll 的访问 * 禁止远程桌面连接 ActiveX 控件在 Internet Explorer 中运行 * 将 Internet 和本地 Intranet 安全区域设置设为“高”，以便在这些区域中阻止 ActiveX 控件和活动脚本 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS13-029）以及相应补丁: MS13-029：Vulnerability in Remote Desktop Client Could Allow Remote Code Execution (2828223) 链接：http://technet.microsoft.com/security/bulletin/MS13-029 |
| id | SSV:60731 |
| last seen | 2017-11-19 |
| modified | 2013-04-11 |
| published | 2013-04-11 |
| reporter | Root |
| title | Microsoft Remote Desktop ActiveX控件远程代码执行漏洞(CVE-2013-1296)(MS13-029) |