CVE-2019-0708: BlueKeep Exploits Could Be Around the Corner
Nearly 80 days after the announcement of BlueKeep, threats of exploitation remain. Those who have not patched remain at risk as rumors of exploit scripts surface.
Background
In May 2019, Microsoft released a critical patch for CVE-2019-0708, dubbed BlueKeep, a critical remote code execution vulnerability that could allow an unauthenticated attacker to exploit a vulnerable host running Remote Desktop Protocol (RDP). Microsoft took the unusual step of publishing a blog post announcing security updates for out-of-support versions of Windows, including Windows XP and Windows 2003, and warning that BlueKeep could be as impactful as the WannaCry worm that took hold in May 2017. Despite the criticality of the issue, reports suggest that over 800,000 machines remain vulnerable. The number of unpatched machines is concerning considering exploits have been developed and proof of concept code (PoC) continues to appear on popular sites like GitHub.
Analisi
As we outlined in our May blog, BlueKeep is a pre-authentication vulnerability that requires no user interaction and allows arbitrary code to be run on a vulnerable remote target. Less than 24 hours after Microsoft’s disclosure on Patch Tuesday, Microsoft Security Response Center (MSRC) warned of the potential for BlueKeep to be widely exploited and wormed. Several projects began to pop up on sites like GitHub with fake exploits and malicious code. Since May, that number continues to increase and there are many claims of working examples.
Our own Tenable Researchers worked tirelessly following Patch Tuesday to develop plugins to identify vulnerable assets both through unauthenticated remote checks, and authenticated local checks. Our authenticated local plugins were released within hours of Microsoft’s disclosure, while an unauthenticated remote plugin was released just a week after the BlueKeep disclosure.
In the weeks since BlueKeep was announced, coverage and interest in exploitation continue to increase. For example, security vendor Immunity has announced an exploit module, and independent researcher zerosum0x0 has developed an exploit which may soon be found in open source tools. In addition, a new variant of the WatchBog malware now includes a scanning module for BlueKeep. The vulnerability has gained so much attention that US-CERT released an alert urging users and administrators to take action immediately.
Solution
Tenable recommends applying the appropriate patches immediately. Microsoft has provided updates for Windows 7, Windows Server 2008 and Windows Server 2008 R2. Additionally, Microsoft has provided patches for out-of-support systems, including Windows XP and Windows Server 2003.
Tenable also recommends the following mitigation steps:
- Enabling Network Level Authentication (NLA). Microsoft recommends NLA as a mitigation, however NLA may be something an organization chooses to deploy in addition to patching.
- Blocking RDP (Default is TCP port 3389) at your perimeter firewall.
- Disabling any unused services.
- Upgrading end-of-life (EOL) operating systems.
Identifying affected systems
Tenable’s remote plugin for CVE-2019-0708 can be found here. This plugin can be used to identify affected systems without providing credentials.
For identifying systems without NLA enabled, please use plugin 58453.
A list of all plugins to identify BlueKeep (CVE-2019-0708) is available here.
Get more information
- Microsoft's CVE-2019-0708 Advisory Page
- MIcrosoft Customer Guidance for CVE-2019-0708
- Critical 'BlueKeep' Vulnerability CVE-2019-0708 Addressed in Patch Tuesday Updates
- WatchBog Malware Adds BlueKeep Scanner (CVE-2019-0708), New Exploits (CVE-2019-10149, CVE-2019-11581)
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 60-day trial of Tenable.io.
Articoli correlati
How to Discover, Analyze and Respond to Threats Faster with Generative AI
June 17, 2024Generative AI (GenAI) is being hailed as the most transformative innovation since the rise of the internet. For security, GenAI can revolutionize the field if applied correctly, especially when it comes to threat detection and response. It enhances efficiency and productivity by swiftly processing and delivering critical information when it matters most.
These Services Shall Not Pass: Abusing Service Tags to Bypass Azure Firewall Rules (Customer Action Required)
June 3, 2024Azure customers whose firewall rules rely on Azure Service Tags, pay attention: You could be at risk due to a vulnerability detected by Tenable Research. Here’s what you need to know to determine if you’re affected, and if so, what you should do right away to protect your Azure environment from attackers.
Cybersecurity Snapshot: EPA Urges Water Plants To Boost Cybersecurity, as OpenSSF Launches Threat Intel Platform for Open Source Software
May 24, 2024Check out the EPA’s call for water plants to beef up their cyber defenses. Plus, open source developers have a new platform to share threat intelligence. Moreover, business email compromise attacks prompt alert from U.K.’s cyber agency. And CISA tackles DNS encryption best practices. And much more!
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
July 5, 2024With growing concern over the recently disclosed regreSSHion vulnerability, we’re explaining here what it is, why it’s so significant, what it could mean for your cloud environment and how Tenable Cloud Security can help.
Cybersecurity Snapshot: Malicious Versions of Cobalt Strike Taken Down, While Microsoft Notifies More Orgs About Midnight Blizzard Email Breach
July 5, 2024Check out the results of a multinational operation against illegal instances of Cobalt Strike. Plus, more organizations are learning that Midnight Blizzard accessed their email exchanges with Microsoft. Meanwhile, Carnegie Mellon has a new report about how to fix and mitigate API vulnerabilities. And two new reports shed light on cyber insurance trends. And much more!
Cybersecurity Snapshot: Memory Bugs Pervasive in Open Source SW, While Car Dealership Chaos Persists After Ransomware Attack
June 28, 2024Check out why memory vulnerabilities are widespread in open source projects. Plus, get the latest on the ransomware attack that’s disrupted car sales in North America. In addition, find out why a majority of organizations grew their cyber budgets this year. And learn how confidential data from U.S. chemical facilities may have been accessed by hackers. And much more!
- Threat Intelligence
- Threat Management
- Vulnerability Management
- Vulnerability Scanning