Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/5/2019
12:15 PM
50%
50%

NSA Issues Advisory for 'BlueKeep' Vulnerability

The National Security Agency joins Microsoft in urging Windows admins to patch 'wormable' bug CVE-2019-0708.

The National Security Agency has issued a release and advisory pushing Microsoft Windows administrators to patch "BlueKeep" (CVE-2019-0708), a critical remote code execution bug in Remote Desktop Services (RDS) on supported and unsupported versions of Windows.

BlueKeep affects Windows 7, Server 2008, Server 2008 R2, Vista, XP, and Server 2003. When it patched the vulnerability earlier this month, Microsoft also released fixes for out-of-support versions of Windows. In a blog post published this week, company officials said they are "confident" an exploit exists for the bug; research shows 1 million devices are still vulnerable.

NSA officials echo Microsoft's concern that BlueKeep could be "wormable" if exploited. The vulnerability is pre-authentication, requires no user interaction, and can spread across machines in the same way WannaCry did when it caused global damage back in 2017.

"It is likely only a matter of time before remote exploitation code is widely available for this vulnerability," NSA officials wrote in a news release. "NSA is concerned that malicious cyber actors will use the vulnerability in ransomware and exploit kits containing other known exploits, increasing capabilities against other unpatched systems."

In its advisory, the NSA provides additional measures businesses can take as they patch and upgrade larger networks. Officials suggest blocking TCP Port 3389 at their firewalls; this port is used by RDP and can block attempts to establish a connection. They also advise enabling Network Level Authentication (NLA), which will require attackers to authenticate to RDS to exploit BlueKeep. Finally, they recommend disabling RDS if it's not required for employees.

Read the full NSA advisory here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd