“To exploit the vulnerability, an attacker could create an RDG file containing specially crafted XML content and convince an authenticated user to open the file,” Microsoft said in an advisory. This could allow an attacker to read arbitrary files via an XML external entity (XXE) declaration. Tracked as CVE-2020-0765, the vulnerability exists when RDCMan improperly parses XML input that contains reference to an external entity. This week, on March 2020 Patch Tuesday, Microsoft revealed that RDCMan is plagued by an information disclosure that would not be addressed, as the application has been deprecated. In the future, you can expect even more capabilities, such as the ability to better manage multiple connections,” Microsoft said in July 2019. “These clients offer increased security, and they are a key part of our engineering roadmap moving forward.
In a support article published last year, the tech giant encouraged users to switch to in-box remote desktop client (MSTSC) or universal Remote Desktop client instead, arguing that RDCMan “has not kept pace with the level of advanced technology” that the company has been aiming for. The application has been around for decades, providing users with the ability to manage multiple remote desktop connections, but Microsoft has long been investing in other solutions to provide users with remote desktop access. Microsoft announced this week that has deprecated Remote Desktop Connection Manager (RDCMan) due to security concerns.
0 kommentar(er)
