Full Report
Microsoft has released updates for several versions of Microsoft Windows, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network. Some Point-of-care products from Siemens Healthineers are affected by this vulnerability. The exploitability of the vulnerability depends on the actual configuration and deployment environment of each product. Siemens Healthineers recommends contacting Siemens Healthineers service desk.
Analysis Summary
# Vulnerability: Remote Desktop Services Remote Code Execution (BlueKeep)
## CVE Details
- **CVE ID:** CVE-2019-0708
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-416: Use After Free
## Affected Systems
- **Products:**
- Microsoft Windows (legacy versions)
- Siemens Healthineers Point-of-Care (POC) products
- **Versions:**
- Windows 7, Windows Server 2008 R2, and Windows Server 2008
- Windows XP and Windows Server 2003 (Critical updates provided despite EOL)
- **Configurations:** Systems exposing Remote Desktop Protocol (RDP) to the network without Network Level Authentication (NLA) enabled.
## Vulnerability Description
This is a "pre-authentication" vulnerability residing in the Remote Desktop Services (formerly Terminal Services). It is a Use-After-Free flaw that occurs when the service improperly handles specially crafted requests. Because the flaw occurs before a user is authenticated, an attacker can send a malicious sequence of packets to the target system via RDP, leading to arbitrary code execution at the system level. This vulnerability is categorized as "wormable," meaning it could spread across networks without user interaction.
## Exploitation
- **Status:** Exploited in the wild; multiple Public PoCs available.
- **Complexity:** Low (for existing exploit frameworks).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full data access).
- **Integrity:** High (System-level modification).
- **Availability:** High (Total system compromise or crash).
## Remediation
### Patches
- **Microsoft Updates:** Install the security updates specific to the OS version (e.g., KB4499164 for Windows 7/Server 2008 R2).
- **Siemens Healthineers:** Users of affected Point-of-care products should contact the Siemens Healthineers service desk immediately to obtain validated patches for medical environments.
### Workarounds
- **Disable RDP:** Disable Remote Desktop Services if they are not required for business operations.
- **Enable NLA:** Enable Network Level Authentication (NLA) on systems running supported versions of Windows. This forces authentication before the vulnerability can be triggered.
- **Firewall Filtering:** Block TCP Port 3389 at the enterprise perimeter.
## Detection
- **Indicators of Compromise:** Monitor for unusual RDP traffic, specifically large numbers of connections to port 3389 from unknown internal or external IPs.
- **Detection Methods:**
- Use vulnerability scanners (Nessus, Qualys) with updated plugins for CVE-2019-0708.
- Monitor for system crashes (BSOD) in `termdd.sys` which may indicate failed exploitation attempts.
## References
- **Microsoft Security Advisory:** hxxps[://]portal[.]msrc[.]microsoft[.]com/en-us/security-guidance/advisory/CVE-2019-0708
- **Siemens Healthineers Security:** hxxps[://]www[.]siemens-healthineers[.]com/en-us/support-updates/cybersecurity
- **CISA Alert:** hxxps[://]www[.]cisa[.]gov/news-events/alerts/2019/06/17/cisa-successfully-tests-bluekeep-exploit