Something similar can be said for Devolution.
RDCman, since you say its a Microsoft tool, probably has prohibitions about distributing the binary, but you can always make your own personal version of the portable app as long as you dont try to distribute it.
To exploit the vulnerability, an attacker could create an RDG file containing specially crafted XML content and convince an authenticated user to open the file. It is a very good remote desktop application. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration. Here's how Microsoft described the vulnerability:Īn information disclosure vulnerability exists in the Remote Desktop Connection Manager (RDCMan) application when it improperly parses XML input containing a reference to an external entity. AccessChk v6.14 This AccessChk version adds support for NULL DACL reporting. The vulnerability was assigned the ID CVE-2020-0765 and the latest RDCMan v2.82 addresses the issue. RDCMan, a utility for managing multiple remote desktop connections, is now part of the Sysinternals family of tools This release fixes CVE-2020-0765, an XML parsing vulnerability. Mark Russinovich, CTO of Microsoft Azure and co-creator of the Sysinternals utility suite, confirmed that RDCMan wouldn't be abandoned and it will now be a part of Sysinternals.Įarlier today, Microsoft also updated its CVE for the security issue found in RDCMan, stating that the problem has been fixed. However, earlier this year in February, it had a change of heart. I know MS stopped updating etc due to a few security bugs as the last one was 2.7. Back in March last year, Microsoft said it will deprecate its Remote Desktop Connection Manager (RDCMan) after a security vulnerability was found in the software. Did a quick search but cant see any posts.
0 kommentar(er)
