Vulnerability: Remote Desktop

On May 14 2019, Microsoft announced a fix for Remote Desktop which patched a critical security vulnerability (CVE-2019-0708). This vulnerability allows the attacker to execute arbitrary code remotely, without authenticating. Microsoft is releasing the patch prior to seeing any exploits in the wild in an effort to prevent the vulnerability being used as an attack vector for a worm or other malware. Microsoft is encouraging administrators to patch all systems as soon as possible.

Recommendations

• Update affected versions of Windows with the latest patch Windows 7, Windows 2008 R2, Windows 2008 and Windows 2003 and Windows XP

Details

Microsoft has released a patch for currently supported and formerly supported versions of Windows which fixes a critical vulnerability in the Remote Desktop service. In CVE-2019-0708, they detail that the Remote Desktop service is vulnerable to a remote code execution vulnerability. Vulnerable systems still being supported include Windows 7, Windows Server 2008 R2, and Windows Server 2008, however, Microsoft is releasing the patch for systems no longer supported like Windows 2003 and Windows XP. The vulnerability takes place before a user authenticates and does not require the attacker to be logged in to exploit the vulnerability. Due to the ability to infect a system without authentication, Microsoft is concerned about the potential for this vulnerability to be used to create worm. While Microsoft has not seen any instances in the wild that exploit this vulnerability, they released a patch preemptively and encouraging administrators to patch systems as soon as possible.