Help Net Securitypublished Nov 15, 07:58 UTC (Nov 15, 2023)ingested Sep 10, 06:11 UTC@helpnetsecurity

June Patch Tuesday forecast: Apply updates before BlueKeep hits the streets

criticalVulnerabilityimportance 60CVE-2019-0708

Read the original

Tagscve-2019-0708 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2019-0708	Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments.	9.8	100%	KEV ransomware PoC ×4	Microsoft Remote Desktop Services	masson the order of millions of internet-exposed RDP endpoints and far more internal systems	May 16, 2019

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2019-0708

Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)

CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.

Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments.

9.8

100%

KEV ransomware PoC ×4

Microsoft Remote Desktop Services

masson the order of millions of internet-exposed RDP endpoints and far more internal systems

May 16, 2019

Full article366 words · extracted from helpnetsecurity.com · click to collapse

Can you believe it is June already? Summer is rapidly approaching, but it’s been slow to warm up our temperatures here in the US. I can’t say the same thing about the temperature in our security community – things have been hot!

The first months of 2019 have seen a record number of vulnerabilities reported and the latest, BlueKeep associated with CVE-2019-0708, has set the forums and security advisory lists on fire.

The May updates from Microsoft included the remediation for this vulnerability found on Windows 7, Windows XP, Server 2003, 2008 and 2008 R2. And yes, you read that correctly. Concern was so huge that Microsoft released public updates for XP and Server 2003. Even the NSA issued an advisory and news article warning to fix this immediately.

BlueKeep is considered a ‘wormable’ vulnerability because it does not require authentication or user interaction to exploit. As such, a worm can spread from system to system taking advantage of the vulnerability. It’s only a matter of time before the first attacks occur, as private MetaSploit modules have already been developed for demonstration.

Make sure you apply the latest updates to your legacy systems before BlueKeep hits the streets and you get an ‘I told you so!’ from your incident response and security team. For continuing updates on the BlueKeep situation as it unfolds check out our blog post.

A quick reminder that Microsoft is continuing its SHA1 to SHA2 update signing process and there are two changes planned for June 18 after Patch Tuesday. Windows 10 updates are automatic but for those customers using WSUS 3.0 SP2, KB4484071 must be manually installed to support SHA2 updates.

Looking ahead to releases for next week:

Google released their latest Chrome update this Wednesday, so don’t anticipate anything new.
Microsoft should release the usual set of updates for the legacy and Windows 10 operating systems, and of course, Office and Office 365. We saw updates for .NET, SQL and SharePoint servers last month, so we may not have many additional updates.
Adobe has not made any pre-announcements around Acrobat and Reader, but they have been doing some major or minor releases each month so be on the lookout.

Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/06/07/june-patch-tuesday-forecast/