CVE-2002-0863 Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine th...
MediumCVSS 5.0
EPSS 22.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft net windows server | = beta3 | No fix listed |
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2000 terminal services | All versions | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
| Microsoft windows nt | = 4.0-sp1 | No fix listed |
| Microsoft windows nt | = 4.0-sp2 | No fix listed |
| Microsoft windows nt | = 4.0-sp3 | No fix listed |
| Microsoft windows nt | = 4.0-sp4 | No fix listed |
| Microsoft windows nt | = 4.0-sp5 | No fix listed |
| Microsoft windows nt | = 4.0-sp6 | No fix listed |
| Microsoft windows nt | = 4.0-sp6a | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20020916 Microsoft Windows Remote Desktop Protocol checksum and keystroke vulnerabilities mailing-list
- 20020918 Microsoft Windows Terminal Services vulnerabilities mailing-list
- win-rdp-checksum-leak(10121) vdb-entry vendor-advisory
- win-rdp-keystroke-monitoring(10122) vdb-entry
- VU#865833 third-party-advisory us-government-resource
- 5711 vdb-entry
- 5712 vdb-entry
- MS02-051 vendor-advisory
- oval:org.mitre.oval:def:199 signature vdb-entry