Skip to main content

BlueKeep Windows Remote Desktop Services RCE Vulnerability

Microsoft has released updates to fix a critical remote code execution (RCE) vulnerability, known as BlueKeep, that affects Remote Desktop Services in some versions of Windows.

Threat ID:
CC-3057
Category:
Exploit
Threat Severity:
High
Threat Vector:
Published:
15 May 2019 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Microsoft has released updates to fix a critical remote code execution (RCE) vulnerability, known as BlueKeep, that affects Remote Desktop Services in some versions of Windows.

Threat details

To exploit the vulnerability an attacker would connect to a device using Remote Desktop Protocol (RDP) and send specially crafted requests. This vulnerability could be exploited by a worm as no authentication or user interaction is required.

An attacker who successfully exploited this vulnerability could execute arbitrary code on the affected system; view, change, or delete data; or create new accounts with full user rights.

For further information:

Update  

Immunity, a cybersecurity research firm, have announced that the latest version of their CANVAS penetration testing toolkit include a BlueKeep exploitation module. This marks the first time that such a module has been made commercially available.

Threat updates

Date Update
25 Jul 2019

Immunity, a cybersecurity research firm, have announced that the latest version of their CANVAS penetration testing toolkit include a BlueKeep exploitation module. This marks the first time that such a module has been made commercially available.

Remediation steps

Type Step

Users and administrators are encouraged to review the following Microsoft update advisories and apply the necessary updates. The updates address the vulnerability by correcting how Remote Desktop Services handles connection requests.

Microsoft has provided advice for administrators on alternative mitigation and workarounds. Microsoft recommends that updates are still installed as soon as possible even if any of these steps are taken:

  • Disabling Remote Desktop Services mitigates this vulnerability.
  • Enabling Network Level Authentication (NLA) on systems running supported editions of Windows 7, Windows Server 2008, and Windows Server 2008 R2 stops unauthenticated attackers from exploiting this vulnerability. If an attacker can authenticate to Remote Desktop Services then an exploit is still possible.
  • If RDP is not used, then blocking TCP port 3389 at the perimeter firewall can prevent attacks that originate outside the enterprise perimeter. Systems could still be vulnerable to attacks from within the perimeter.

Additionally, administrators can consider the following steps to help prevent and detect attacks using RDP:

Update  

Microsoft has released additional updates to address an issue with some of the above patches where Internet Explorer 11 and Microsoft Edge could have been prevented from accessing .gov.uk websites that do not support HTTP Strict Transport Security (HSTS). Users and administrators are encouraged to review the following Windows Knowledge Base articles and apply the relevant additional updates:

Update  

Microsoft has released updated patches via Microsoft Monitoring Agent (MMA) to address the installation issues experienced by some organisations using 3rd party anti-virus products. Users and adminstrators are encouraged to review the following guidance and apply the updates immediately:

  1. Confirm MsSenseS.exe is version 10.3720.16299.1030
  2. Install the latest roll-up and confirm success.
  3. Push the patch out via your usual patching mechanism.

Update  

Microsoft has released further information to address partial installation issues some organisations are experiencing. 

  1. Check the Windows ATP build number using the following command: reg query "HKLM\Software\Microsoft\Windows Advanced Threat Protection\status\”
  2. Examine the output for the string 3346346 (please note the output may vary slightly between Window operating system versions)) as follows: ConfigurationVersion REG_SZ 3720.3346346.3327927
  3. Reboot the affected device
  4. Apply the May 2019 update package.
  5. Reboot the affected device once more.

They have also recommended restarting the "HealthService" service should the update not apply.

 

CVE Vulnerabilities

Status

CVE-2019-0708

Last edited: 14 February 2020 2:44 pm