When’s the last time you installed Windows updates?
Microsoft published information on a critical remote code execution vulnerability dubbed the Bluekeep RDP vulnerability (CVE-2019-0708) in May 2019. Windows 8 and newer systems have a default RDP setting requiring Network Level Authentication that mitigates the risk of this vulnerability while systems running Windows 7 and Server 2k8 or 2k8 R2 can be patched. LARG*net immediately scanned all member networks to determine if whether anyone was externally vulnerable and thankfully no one was.
Bluekeep will be entering Metasploit in the near future thus making this vulnerability far more accessible to the masses who might want to exploit it.
Yesterday Microsoft released 4 new Remote Code Execution Vulnerabilities for Remote Desktop Services: CVE-2019-1181, CVE-2019-1182, CVE-2019-1222, and CVE-2019-1226.
Not only are all 4 are worse than Bluekeep but all involve pre-authentication remote code execution against a system service. New CVEs for Hyper-V and DHCP were also announced. Essentially all Windows systems should be patched ASAP.
But wait there’s more:
Tavis Ormandy is the Wayne Gretzky of the Information Security industry. He is a white hat hacker employed by Google’s Project Zero team to find zero-day vulnerabilities. His latest project is documented in this Project Zero blog post from last month.
He outlines an entirely new attack surface for Microsoft operating systems. The tools used in this discovery will result in years of new CVEs.
You can see the very technical responsible disclosure timeline.
Fortunately Microsoft has released a patch for this problem, too.
Moral of this story? Patch all of your Microsoft OS immediately and regularly!