Full Report
Microsoft has released updates for several versions of Microsoft Windows, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network. Some Advanced Therapy products from Siemens Healthineers are affected by this vulnerability. The exploitability of the vulnerability depends on the actual configuration and deployment environment of each product.
Analysis Summary
# Vulnerability: Remote Desktop Services Remote Code Execution (BlueKeep)
## CVE Details
- **CVE ID:** CVE-2019-0708
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-416 (Use After Free)
## Affected Systems
- **Products:**
- Microsoft Windows (Legacy versions)
- Siemens Healthineers Advanced Therapy products (specific imaging and therapy systems utilizing affected Windows OS)
- **Versions:**
- Windows 7, Windows Server 2008 R2, and Windows Server 2008.
- Windows XP and Windows Server 2003 (Extended support updates).
- **Configurations:** Systems where Remote Desktop Services (RDS) / Remote Desktop Protocol (RDP) is enabled and exposed to the network without proper authentication mechanisms.
## Vulnerability Description
This is a "wormable" Remote Code Execution (RCE) vulnerability in Remote Desktop Services. It occurs due to a Use-After-Free (UAF) flaw in the way the service handles specific specially crafted requests. An attacker can send a sequence of packets to the target system's RDP service via the network; if successful, this allows the execution of arbitrary code with SYSTEM-level privileges without requiring user interaction or authentication.
## Exploitation
- **Status:** Exploited in the wild / PoC available.
- **Complexity:** Low.
- **Attack Vector:** Network (Unauthenticated).
## Impact
- **Confidentiality:** Total (Full access to system data).
- **Integrity:** Total (Ability to modify/delete files and system configurations).
- **Availability:** Total (Ability to crash the system or deploy ransomware/worms).
## Remediation
### Patches
- **Microsoft:** Apply security updates for Windows 7, Server 2008, XP, and 2003 as per Microsoft’s May 2019 advisory.
- **Siemens Healthineers:** Users should refer to Siemens-specific product security advisories to apply validated patches for Advanced Therapy systems.
### Workarounds
- **Disable RDP:** If Remote Desktop Services are not required, disable the service entirely.
- **Enable NLA:** Enable Network Level Authentication (NLA) on supported systems to force authentication before the vulnerability can be triggered.
- **Firewall Filtering:** Block TCP Port 3389 at the enterprise perimeter or host-based firewall.
## Detection
- **Indicators of Compromise:** Unusual traffic on TCP Port 3389; unexpected system crashes (BSOD) resulting from failed exploit attempts.
- **Detection methods and tools:**
- Vulnerability scanners (e.g., Nessus, Qualys) using specialized plugins for CVE-2019-0708.
- Network Intrusion Detection Systems (NIDS) signatures for RDP binding to the "MS_T120" static channel.
## References
- **Microsoft Security Advisory:** hxxps[://]portal[.]msrc[.]microsoft[.]com/en-US/security-guidance/advisory/CVE-2019-0708
- **Siemens Healthineers Security Advisory:** hxxps[://]www[.]siemens-healthineers[.]com/support-documentation/cybersecurity
- **CISA Alert:** hxxps[://]www[.]cisa[.]gov/news-events/alerts/2019/06/17/cisa-confirms-bluekeep-vulnerability-exploitation-triage-and-mitigation