Full Report
Microsoft has released updates for several versions of Microsoft Windows, which fix vulnerabilities in the Remote Desktop Service that are discussed under the name DejaBlue. The vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network. All Siemens Healthineers products from all business lines have been evaluated. Most Siemens Healthineers products are not affected by the vulnerabilities because they do not provide the option to activate the Remote Desktop Service, implement other controls that mitigate the vulnerabilities, use a version of Microsoft Windows that is not affected, or are not based on Microsoft Windows. This advisory provides a full list of affected products from Siemens Healthineers and provides recommendations to mitigate the vulnerabilities.
Analysis Summary
# Vulnerability: DejaBlue (Remote Desktop Services RCE)
## CVE Details
*Note: While the provided text references the "DejaBlue" family of vulnerabilities, the specific identifiers associated with this disclosure typically include:*
- **CVE ID:** CVE-2019-1181, CVE-2019-1182, CVE-2019-1222, CVE-2019-1226
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-399 (Resource Management Errors) / CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Siemens Healthineers products (multiple business lines).
- **Versions:** Specific products utilizing vulnerable versions of Microsoft Windows (Windows 7 SP1, Windows 8.1, Windows 10, and Windows Server versions 2008 R2 SP1, 2012, 2012 R2, 2016, and 2019).
- **Configurations:** Systems where the Remote Desktop Service (RDS) is enabled and exposed to the network without Network Level Authentication (NLA) or other mitigating controls.
## Vulnerability Description
DejaBlue refers to a group of pre-authentication Remote Code Execution (RCE) vulnerabilities in Microsoft’s Remote Desktop Services. Similar to "BlueKeep," these flaws exist in the way the service handles specific specially crafted requests. Because the flaw occurs at the pre-authentication stage, an attacker does not need valid credentials or user interaction to exploit the system. The vulnerability is "wormable," meaning it could potentially spread from one vulnerable computer to another within a network automatically.
## Exploitation
- **Status:** PoC available (Publicly discussed and researched; not currently noted as widely exploited in the wild at the time of the Siemens advisory).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
- **Total Impact:** Full system compromise; arbitrary code execution under the context of the SYSTEM account.
## Remediation
### Patches
- Siemens Healthineers recommends applying the relevant Microsoft Security Updates for the specific Windows version integrated into the product.
- Users should refer to the full product list provided in the official Siemens advisory to identify product-specific patch availability.
### Workarounds
- **Disable Remote Desktop Services:** If the service is not required for operation, disable it entirely.
- **Enable Network Level Authentication (NLA):** NLA requires an attacker to have a valid account to reach the vulnerable stage of the service.
- **Block Port 3389:** Use a firewall to block all incoming traffic on TCP port 3389 at the enterprise perimeter.
## Detection
- **Indicators of compromise:** Unusual spikes in RDP traffic, unauthorized system-level changes, or unexpected service crashes (svchost.exe).
- **Detection methods and tools:**
- Vulnerability scanners (e.g., Nessus, Qualys) updated with DejaBlue plugins.
- Monitoring for unauthorized connections to TCP port 3389.
## References
- **Siemens Healthineers Advisory:** hxxps[://]www[.]siemens-healthineers[.]com/support-documentation/cybersecurity
- **Microsoft Security Guidance:** hxxps[://]msrc[.]microsoft[.]com/update-guide/en-US/vulnerability/CVE-2019-1181
- **NIST NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2019-1182