CVE-2011-0029

Vulnerability

CVE-2011-0029 is an untrusted search path vulnerability in Microsoft Remote Desktop Connection (RDC) versions 5.2, 6.0, 6.1, and 7.0. When a user opens a legitimate Remote Desktop configuration (.rdp) file, the client loads external libraries by searching the current working directory. If a specially crafted DLL is placed in that directory, it can be loaded instead of a legitimate system library. An attacker must first convince the user to open a .rdp file from an untrusted remote file system location or WebDAV share [1].

Exploitation

To exploit the vulnerability, an attacker hosts a malicious DLL in a network folder or WebDAV share that also contains a legitimate .rdp file. The victim must browse to that location and open the .rdp file. The Remote Desktop client then loads the attacker-supplied DLL from the current working directory rather than from a secure system path. The attack does not require authentication or prior access to the victim system; user interaction is the sole trigger [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the logged-on user. While the vulnerability is initiated locally, the attack can be launched remotely by hosting the malicious files on a network share. The code execution can lead to full compromise of the user's session, including access to files, credentials, and system resources. The CVSS v3 score of 7.4 reflects the high impact on confidentiality, integrity, and availability [1][2].

Mitigation

Microsoft released security bulletin MS11-017 in March 2011, which updates the Remote Desktop Connection client to properly validate library search paths. The update is classified as Important and applies to all affected versions. Users with automatic updating enabled receive the patch automatically; others should manually install it via Microsoft Update. There are no effective workarounds other than applying the update, but users are advised to avoid opening .rdp files from untrusted network locations until patched [1][2].