Intrusion Prevention



This indicates an attack attempt to exploit a remote Code Execution vulnerability in Microsoft Windows that was disclosed by Shadow Broker as ESTEEMAUDIT exploit.
The vulnerability is caused by an error when the RDP service handles a malicious request. A remote attacker may be able to exploit this to gain control of vulnerable systems via a crafted client request.

Affected Products

Windows XP
Windows XP SP1
Windows XP SP2
Windows XP SP3
Windows 2003
Windows 2003 SP1
Windows 2003 SP2


System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Upgrade to the latest version available from the website.

CVE References

CVE-2017-0176 CVE-2017-9073