Microsoft plugs wormable RDP flaw, new speculative execution side channel vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments. | 9.8 | 100% | KEV ransomware PoC ×4 |
| masson the order of millions of internet-exposed RDP endpoints and far more internal systems | |
| CVE-2019-0725 | A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Server Remote Code Exec A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Server Remote Code Execution Vulnerability'. NVD description · AI analysis pending | 9.8 | 28% |
| — | ||
| CVE-2019-0863 | Local Privilege Escalation Flaw in Microsoft Windows Error Reporting (WER) CVE-2019-0863 is an elevation of privilege vulnerability in Microsoft Windows Error Reporting (WER), caused by the way WER handles files on affected Windows releases. A local attacker who can already execute code on a vulnerable machine with limited privileges can trigger the flaw without user interaction and gain higher local privileges, with high impact on confidentiality, integrity, and availability per the CVSS vector. Anyone running the listed releases is affected: Windows 10 versions 1507 through 1903, Windows 7, Windows 8.1, Windows RT 8.1, and Windows Server versions 1803 and 1903; systems current on Microsoft's security updates are not vulnerable. The flaw is confirmed exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 (ransomware association unknown) — although no public proof-of-concept is known, and EPSS puts the 30-day exploitation probability at 5.2% (92nd percentile). The required action per CISA is to apply updates per vendor instructions. Do: Apply Microsoft's security updates for each affected release as the CISA KEV entry requires; the flaw was fixed in 2019 cumulative updates, so any system current on monthly servicing is already protected. Prioritize patching multi-user and remote-access systems (RDS/VDI hosts, jump boxes, shared workstations) where low-privileged users can run code and escalate, and migrate unpatched Windows 7/8.1/RT 8.1 machines — many now past end of support — to a supported, patched Windows release. | 7.8 | 5% | KEV |
| masshundreds of thousands to millions of currently unpatched Windows endpoints (affected releases once ran on hundreds of millions of devices) | |
| CVE-2019-0932 | An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'. An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'. NVD description · AI analysis pending | 5.9 | 5% |
| — |
Full article672 words · extracted from helpnetsecurity.com · click to collapse
For May 2019 Patch Tuesday, Microsoft has released fixes for 79 vulnerabilities, 22 of which are deemed critical. Among the fixes is that for CVE-2019-0708, a “wormable” RDP flaw that is expected to be weaponised by attackers very soon.
About CVE-2019-0708
It’s a remote code execution vulnerability in Remote Desktop Services (formerly known as Terminal Services) that allows unauthenticated attackers to connect to the target system using RDP and send specially crafted requests.
The flaw affects Windows 7, Windows Server 2008 R2, and Windows Server 2008 (still in-support) and Windows 2003 and Windows XP (out-of-support). Due to the danger it presents, Microsoft has released security updates for all of them (those for out-of-support Windows versions can be found here).
Customers running Windows 8 and Windows 10 are not affected by this vulnerability.
“The Remote Desktop Protocol (RDP) itself is not vulnerable. This vulnerability is pre-authentication and requires no user interaction. In other words, the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017,” Microsoft explained the danger.
“While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware.”
For those who cannot apply the security updates, Microsoft advises either disabling RDP services if they are not required, blocking TCP port 3389 at the enterprise perimeter firewall, and/or enabling Network Level Authentication (NLA) on systems running supported editions of Windows 7, Windows Server 2008, and Windows Server 2008 R2.
The latter is only a partial mitigation. With NLA enabled, systems are protected against “wormable” malware or advanced malware threats that could exploit the vulnerability, as NLA requires authentication before the vulnerability can be triggered.
“However, affected systems are still vulnerable to Remote Code Execution (RCE) exploitation if the attacker has valid credentials that can be used to successfully authenticate,” Microsoft noted. “It is for these reasons that we strongly advise that all affected systems – irrespective of whether NLA is enabled or not – should be updated as soon as possible.”
There are no public exploits for it yet and no indication that it’s already being actively exploited.
The remaining fixes
As per usual, the addressed vulnerabilities span a variety of Microsoft products, including Windows, the two company browsers, Microsoft Office, Visual Studio, the .NET Framework, and so on.
Among the most notable are:
- CVE-2019-0863, a Windows Error Reporting elevation of privilege vulnerability that is already being exploited in the wild (likely in limited attacks)
- CVE-2019-0725, a Windows DHCP Server RCE vulnerability that can be exploited by a remote unauthenticated attacker by sending a specially crafted packet to an affected DHCP server (meaning: it’s also “wormable”).
- CVE-2019-0932, a vulnerability in Skype for Android that could allow attackers to listen in on a user’s Skype conversations. The vulnerability was publicly known before this disclosure, but there is no indication that it’s being exploited in the wild.
Microsoft has also released a guidance document on how to mitigate a new subclass of speculative execution side channel vulnerabilities known as Microarchitectural Data Sampling (aka ZombieLoad, RIDL and Fallout).
“An attacker who successfully exploited these vulnerabilities may be able to read privileged data across trust boundaries. In shared resource environments (such as exists in some cloud services configurations), these vulnerabilities could allow one virtual machine to improperly access information from another. In non-browsing scenarios on standalone systems, an attacker would need prior access to the system or an ability to run a specially crafted application on the target system to leverage these vulnerabilities,” the company explained.
“Microsoft has released software updates to help mitigate these vulnerabilities. To get all available protections, firmware (microcode) and software updates are required. This may include microcode from device OEMs. In some cases, installing these updates will have a performance impact. We have also acted to secure our cloud services.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/05/15/may-2019-patch-tuesday/