The Threat
On Friday September 6th, 2019, Metasploit added an exploit module for the vulnerability known as BlueKeep (CVE-2019-0708) [1]. Unlike the previous publicly released BlueKeep exploits, the recent release allows for remote-code execution. eSentire has not seen attacks in the wild at this time, but exploitation in the near future is almost certain due to this Metasploit release.

Companies that have not already applied the Microsoft security updates for CVE-2019-0708 should do so immediately. Companies that have already applied the security updates for CVE-2019-0708 are not affected by this release.

What we’re doing about it

  • Updated Managed Vulnerability Service (MVS) plugins identify this vulnerability
  • The Threat Intelligence team is monitoring this topic for additional information
  • Detection methods for exploitation of CVE-2019-0708 are under evaluation

What you should do about it

  • After performing a business impact review, apply the official Microsoft security updates to affected systems [2] [3]
  • If RDP is not actively required, consider disabling the service or limiting access

 Additional information

BlueKeep is a critical vulnerability affecting Microsoft Remote Desktop Services (RDS). If exploited, a remote and unauthenticated attacker can execute arbitrary code on vulnerable systems or cause a denial of service. User interaction is not required for successful exploitation. 

 Affected Windows Versions:

  • Windows 7
  • Windows Server 2008 R2 (various versions)
  • Windows Server 2008 (various versions)

Affected Out-of-Support Versions:

  • Windows XP (various versions)
  • Windows Server 2003 (various versions)

References:

[1] https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/

[2] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 

[3] https://support.microsoft.com/en-gb/help/4500705/customer-guidance-for-cve-2019-0708

[4] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

[5]  https://support.microsoft.com/en-gb/help/4500705/customer-guidance-for-cve-2019-0708

 

See the latest security advisories

Articles and reports written by eSentire staff and our Threat Intelligence Research Group.

Ready to get started?
We're here to help.

Get Started
Reach out to schedule a meeting and learn more about our Managed Detection and Response, Risk Advisory and Managed Prevention capabilities.