{"id":2132,"date":"2012-03-26T10:49:11","date_gmt":"2012-03-26T14:49:11","guid":{"rendered":"https:\/\/www.bumc.bu.edu\/it\/?p=2132"},"modified":"2012-09-25T09:04:21","modified_gmt":"2012-09-25T13:04:21","slug":"security-alert-for-microsoft-windows-users-and-vpn-required-for-rdp","status":"publish","type":"post","link":"https:\/\/www.bumc.bu.edu\/it\/2012\/03\/26\/security-alert-for-microsoft-windows-users-and-vpn-required-for-rdp\/","title":{"rendered":"Security Alert for Microsoft Windows Users and VPN Required for RDP"},"content":{"rendered":"

(View the<\/em> original post from IS&T\u00a0here<\/a>)<\/em><\/strong><\/h3>\n

Summary<\/strong><\/h3>\n

Action Required for all Microsoft Windows Users:<\/strong><\/h4>\n

<\/strong><\/p>\n

    \n
  1. If you are running Microsoft Windows and you do not have it set to Automatically Update, you should run Windows Update immediately.\u00a0 See instructions at\u00a0www.bu.edu\/tech\/desktop\/virus-protection-security\/safe-computing\/autoupdate\/<\/a> and confirm that you have the correct patches using the instructions below on this page.<\/li>\n
  2. If you\u00a0do <\/em>have Automatic Updates turned on, you should have received the patch last Tuesday and you are all set \u2013 no further action is required toward installing it. <\/strong>You can confirm that you are updating automatically by following the instructions at\u00a0www.bu.edu\/tech\/desktop\/virus-protection-security\/safe-computing\/autoupdate\/<\/a>. <\/strong><\/li>\n
  3. If you use Microsoft Windows Remote Desktop (RDP) to connect to a BU computer from outside of BU,\u00a0you will need to connect to the VPN prior to connecting via RDP \u2013 login at\u00a0http:\/\/vpn.bu.edu<\/a>.<\/strong><\/li>\n
  4. If you have set up your system to allow remote access, or if you run a server, see the additional instructions below.<\/li>\n<\/ol>\n

    Details<\/strong><\/h3>\n

    <\/strong><\/p>\n

    The Problem:<\/strong><\/h4>\n

    On Tuesday, March 13, Microsoft announced that a critical vulnerability had been discovered in all versions of Windows from XP and up.\u00a0 This vulnerability affects the Remote Desktop (RDP) feature of Windows.\u00a0 RDP allows a remote user to connect to the computer and the vulnerability may allow even an unauthorized person to do so.<\/p>\n

    The Impact:<\/strong><\/h4>\n

    An exploit has already been released that will cause a Blue Screen of Death on Windows 7 and a Denial of Service on Windows XP.\u00a0 It is expected that another exploit will soon be released that will allow an attacker to have complete control of the computer.\u00a0 After that, the next expected step is that a self-replicating worm will be released that will automatically jump from host to host, granting the attacker access to the system and taking any other action the attacker may wish.<\/p>\n

    The Solution:<\/strong><\/h4>\n

    Microsoft has released a patch for this vulnerability.\u00a0 See below for details on installing it.<\/p>\n

    What IS&T and the IT Partners are doing:<\/strong><\/h4>\n