CVE-2005-1794 | Microsoft Terminal Server - Remote Desktop Protocol (RDP) 5.2 Operational Intel

Executive Risk Summary

"A vulnerability in Microsoft Terminal Server using Remote Desktop Protocol (RDP) 5.2 allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks. This is due to the storage of an RSA private key in mstlsapi.dll, which is used to sign a certificate."

Anticipated Attack Path

1. Exploitation of the RDP 5.2 vulnerability
2. Spoofing of public keys of legitimate servers
3. Conducting of man-in-the-middle attacks

Am I Vulnerable?

Verify the version of RDP being used
Check for any suspicious certificate activity
Monitor for unusual network traffic

Operational Audit Arsenal

Target Type DLL

Target Asset mstlsapi.dll

Standard Path C:\Windows\System32

PowerShell

# 🛠️ Senior Engineer Universal Audit
# Target: mstlsapi.dll (DLL)
$Targets = 'mstlsapi.dll'
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")

Get-ChildItem -Path $SearchPaths -Include $Targets -Recurse -ErrorAction SilentlyContinue | 
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}