Well, I think the goal is to point out vulnerabilities with the service. As you point out, it may be possible for someone to bruteforce accounts through terminal services. However, this isn't really a vulnerability. The results of Nessus do you make you aware that TS is reachable by the scanner. Your lock out policy, account passwords, and any other number of things can come into play. That's not what Nessus wants to inform you of. Otherwise you'd get a lecture for any service that accepts credentials (SSH, mySQL, Oracle, Web Admin directories, htaccess protected folder, ftp, etc.).
The scanner is pointing out that the server is suceptible to a MITM attack that can let an attacker grab all your traffic destined to TS server and read as it RC4 wasn't applied. The link in the report should be there and point to http://www.oxid.it/downloads/rdp-gbu.pdf. This does a pretty good job of explaining the vulnerability and the risks. Alternatively, if you are looking to protect yourself better. You can setup firewall ACLs or use IPSec (with ACLs if you want). There's a number of things you can do to minimize the risk..to include eliminating it by terming off TS. ;) Hope that helps. Steven securityzone.org > Plugin 18405 very sensibly generates this report: > > "Synopsis : It may be possible to get access to the remote host. > Description : The remote version of Remote Desktop Protocol Server > (Terminal Service) is vulnerable to a man in the middle attack. An > attacker may exploit this flaw to decrypt communications between client > and server and obtain sensitive information (passwords ...)." > > When distributing Nessus reports I have to explain that where terminal > services must be enabled then the scope of exposure of the service > should be minimised, probably using the Windows host-based firewall, and > that the accounts exposed should have very strong passwords. This is > because I think remote brute force or dictionary log-in attempts using > e.g. TSgrinder could be more of a concern that the possibility of a > sophisticated man in the middle attack. I'm not sure whether other would > agree, however, it would make my life a little easier if the scope and > password strength aspects could also be explained in the plug-in output. > > > -- > Carl Nelson > Distributed Systems Services, Computer Centre, University of Leicester, > Leicester, LE1 7RH, U.K. > Tel: +44 (0)116 252 2060, Fax: +44 (0)116 252 5027 > _______________________________________________ > Nessus mailing list > [email protected] > http://mail.nessus.org/mailman/listinfo/nessus > _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
