Hey folks, it's time to patch your Windows PCs! Somebody tipped Microsoft off to a vulnerability in the way Windows handles the remote desktop protocol, and the problem turned out to be a biggie: the exploit allows attackers to run code without any user permissions whatsoever, and all Windows operating systems from XP on up are affected. The good news is that Microsoft has already issued a security patch for the problem. The bad news? Microsoft has taken the unusual step of suggesting you install the patch immediately, since it expects baddies to exploit the gaping security hole quickly.
"Due to the attractiveness of this vulnerability to attackers, we anticipate that an exploit for code execution will be developed in the next 30 days,"
Microsoft wrote in a blog post
MS12-020 security bulletin
sums up the heart of the problem: "The (CVE-2012-0002 RDP vulnerability) could allow remote code execution if an attacker sends a sequence of specially crafted RDP packets to an affected system."
Note that the remote desktop protocol is disabled by default in Windows. If you haven't turned RDP on, you aren't vulnerable to this critical exploit. Businesses use remote desktops far more often than home users; if your IT department can't give the patch a thumbs-up in the next thirty days, the aforementioned blog post also includes information about how to enable Remote Desktop's Network-Level Authentication option to reduce the danger somewhat.
Automatic updaters should have received the MS12-020 update as part of yesterday's Patch Tuesday package.