Critical vulnerability in Microsoft remote desktop services

Microsoft has published information about a critical vulnerability affecting older versions of Windows. They have released patches for the following versions:

• Windows 7
• Windows Server 2008 R2
• Windows Server 2008
• Windows Server 2003
• Windows XP.

Patches for supported versions of Windows External Link

Microsoft have taken the unusual step of releasing patches for legacy systems:

Patches for unsupported versions of Windows External Link

The following versions of Windows are not affected:

• Windows 8
• Windows 10
• versions of Windows Server since Server 2012.

Microsoft has released information about, as well as patches for, a critical remote code execution vulnerability. This affects remote desktop services for older versions of Windows.

The vulnerability is wormable, occurs pre-authentication and requires no user interaction.

While this vulnerability isn’t being actively exploited at this point, any future malware that exploits this vulnerability could propagate between vulnerable networks, as we observed in the 2017 WannaCry attacks.

CVE-2019-0708 Microsoft security advisory External Link

You are at risk if you are running:

• Windows 7 or older, or
• Windows Server 2008 R2 or older,

and haven’t applied the latest security patches.

CERT NZ strongly recommends that Windows users ensure that their systems are currently patched and up-to-date.

Currently supported versions are:

• Windows 7
• Windows Server 2008 R2
• Windows Server 2008.

Patches for supported versions of Windows External Link .  

Unsupported versions are:

• Windows Server 2003
• Windows XP.

Patches for unsupported versions of Windows External Link .

It’s important users of these systems apply these patches immediately, if they have not already been applied. Due to its critical nature, CERT NZ recommends patching as soon as possible.

For users of the following systems, there is no action to take as these systems are not affected:

• Windows 8
• Windows 10
• Server 2012 or newer.

CERT NZ recommends disallowing RDP access from the internet if you don’t need it. If you need remote access, configure a VPN with multi-factor authentication, rather than expose RDP to the internet

A partial mitigation is to enable network-level authentication. However, as this is not a complete mitigation, patching is still required.