Nicknamed BlueKeep, a critical remote code execution vulnerability affects some old versions of Windows.
On 14 May 2019, Microsoft released fixes for a critical Remote Code Execution vulnerability called CVE-2019-0708 (already nicknamed”BlueKeep”). The vulnerability concerns Remote Desktop Services (before that called Terminal Services) that affects certain older versions of Windows.
CVE-2019-0708 could allow an attacker to execute remote code on a vulnerable machine that’s running Remote Desktop Protocol (RDP). As the vulnerability is wormable, it could spread extremely rapidly and compromise millions of systems around the world in a very short span of time.
It seems that developing a reliable exploit to leverage this vulnerability is not a simple endeavor – so far there is no publicly available exploit code. But development is active, and we’re not far off from it appearing out in the wild for attackers to leverage.
This RDP Vulnerability (BlueKeep) should be taken more seriously than your average security hole. Microsoft’s actions indicate the severity of the threat because it has taken the extra step of not only issuing fixes for the currently supported versions of their operating system (Windows 7, Windows Server 2008 R2, Windows Server), but they also extended coverage to Windows XP, Windows Vista and Windows Server 2003. Systems that run Windows 8 and 10 are not affected by CVE-2019-0708.
The scary thing is this vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
While this vulnerability seems to only target retired systems, the fact is that there are still tens of millions of legacy machines running Windows XP and Windows Server 2003, many of which are also internet-facing. For example, Windows XP—released in 2001—still has a 3.57% market share—which means that even though this vulnerability targets, among others, an operating system that is 18 years old, it still not only poses a tremendous risk for the various entities using these platforms, but for the public as a whole due to its potential for wormability and the fact that many of these devices may still be located in critical locations.
What You Should Do About BlueKeep
- Focus on patching externally facing RDP servers, then move on to critical servers such as domain controllers and management servers. Finally patch non-critical servers that have RDP enabled, along with the rest of the desktop estate. You can find more information on applying the patch from Microsoft’s support pages.
- Enable Network Level Authentication. Network Level Authentication (NLA) can be used to partially mitigate this vulnerability. Enabling NLA will force attackers to have valid credentials in order to perform RCE.
- Block TCP port 3389 at the enterprise perimeter firewall. TCP port 3389 is used to initiate a connection with the affected system. Blocking this port with a firewall, preferably at the network perimeter level, will help to protect systems that are within the secured network.
- Disable Remote Desktop Services if they are not required. In case you do not need these services in your environment, consider disabling them. Disabling unused and unneeded services helps reduce your exposure to security vulnerabilities and is a security best practice.
Microsoft’s support site provides additional guidance and links to the security updates.
To be on the safe side, we urge administrators to fix the flaw on a company-wide scale as soon as possible. If you have any question, please reach out to our support team.