Microsoft Remote Desktop Services Remote Code Execution Vulnerability

[icecream-guy]

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.


--
https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708

[Otanx]

You know it is a big deal when they back port patches to XP, and 2003. The only saving grace is it isn't a publicly disclosed vulnerability, but that won't last.

-Otanx

[deanwebb]

This is a VERY big deal.

Damn RDP...

[Dieselboy]

Fantastic! 

Once a few years ago I was trying to RDP to my windows XP system over the internet at home (before VPN). I knew something was wrong because the RDP screen looked like Windows Server 2003. I didnt recognise the domain either. I checked the IP address and I had mis-typed my IP and got someone elses Windows server.

Knowing cloud and engineers - I bet there are a ton of Windows VMs running in Azure that are accepting RDP connections from any source IP.

[icecream-guy]

we're tightening firewalls to remove the insecure protocols.  RDP, TFTP, FTP, etc.  users still wanting to use these protocols, have to go through the security team to get a waiver to make (and document) the exception.  The RDP guys are like 

[deanwebb]

Fantastic! 

Once a few years ago I was trying to RDP to my windows XP system over the internet at home (before VPN). I knew something was wrong because the RDP screen looked like Windows Server 2003. I didnt recognise the domain either. I checked the IP address and I had mis-typed my IP and got someone elses Windows server.

Knowing cloud and engineers - I bet there are a ton of Windows VMs running in Azure that are accepting RDP connections from any source IP.

I'm always terrified of systems with RDP open to the Internet.

This video is now relevant to this thread:

https://www.youtube.com/watch?v=NUNEZ9-4v_E

[Dieselboy]

I have it how I like it