Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Microsoft Warns of New BlueKeep-Like, Wormable RDS Vulnerabilities

Microsoft’s latest security updates patch more wormable vulnerabilities related to Remote Desktop Services (RDS) and the company has published a blog post to warn users about the risk they pose.

Microsoft’s latest security updates patch more wormable vulnerabilities related to Remote Desktop Services (RDS) and the company has published a blog post to warn users about the risk they pose.

Microsoft’s August 2019 Patch Tuesday updates fix over 90 flaws, including some critical RDS vulnerabilities that can be exploited by sending specially crafted requests to the targeted system via RDP. Exploitation of the vulnerabilities does not require any user interaction or authentication.

Microsoft’s blog post warns users of two vulnerabilities, CVE-2019-1181 and CVE-2019-1182, which the company says are similar to the bug tracked as BlueKeep and CVE-2019-0708, and are both wormable.

“These two vulnerabilities are also ‘wormable’, meaning that any future malware that exploits these could propagate from vulnerable computer to vulnerable computer without user interaction,” said Simon Pope,  Director of Incident Response at MSRC.

However, experts have pointed out that two other RDS flaws resolved this month, CVE-2019-1222 and CVE-2019-1226, also have a very similar description and are also more likely to be exploited in malicious attacks.

CVE-2019-1181 and CVE-2019-1182 appear to impact all supported versions of Windows, while CVE-2019-1222 and CVE-2019-1226 only affect Windows 10, Windows Server, and Windows Server 2019.

Users can partially mitigate these types of vulnerabilities by enabling Network Level Authentication (NLA). This method only works as long as the attacker doesn’t find a way to obtain valid credentials.

Microsoft has issued several warnings about the BlueKeep vulnerability. The company’s most recent blog post on the matter, published on August 8, informed users that there were still more than 400,000 endpoints vulnerable to attacks due to the lack of NLA.

Advertisement. Scroll to continue reading.

In a report published recently, cybersecurity firm BitSight said it had seen over 788,000 systems that were still vulnerable to BlueKeep attacks as of July 23.

While several companies and researchers claim to have developed proof-of-concept (PoC) exploits for the BlueKeep vulnerability, attacks have yet to be seen in the wild. However, many, including Microsoft, believe it’s only a matter of time until we see malicious attacks. Others have pointed out that BlueKeep may have already been exploited in targeted attacks that have not been made public.

Related: Crypto-Mining Botnet Implements BlueKeep Scanner

Related: NSA Urges Windows Users to Patch ‘BlueKeep’ Vulnerability

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.