Full Report
Microsoft has released updates for several versions of Microsoft Windows, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network. Some Radiography and Mobile X-ray products from Siemens Healthineers are affected by this vulnerability. The exploitability of the vulnerability depends on the actual configuration and deployment environment of each product. Siemens Healthineers recommends contacting Siemens Healthineers service desk.
Analysis Summary
# Vulnerability: Remote Desktop Services Remote Code Execution (BlueKeep)
## CVE Details
- **CVE ID:** CVE-2019-0708
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-416: Use After Free
## Affected Systems
- **Products:**
- Microsoft Windows (legacy versions)
- Siemens Healthineers Radiography products
- Siemens Healthineers Mobile X-ray products
- **Versions:**
- Windows 7, Windows Server 2008 R2, and Windows Server 2008.
- Legacy systems: Windows XP and Windows Server 2003.
- Specific Siemens Healthineers product versions are dependent on the underlying Windows OS.
- **Configurations:** Systems where Remote Desktop Services (RDS) / Remote Desktop Protocol (RDP) is enabled and exposed to the network without Network Level Authentication (NLA).
## Vulnerability Description
This is a "use-after-free" vulnerability existing in Remote Desktop Services. It occurs during the pre-authentication stage when the service improperly handles specially crafted requests. An attacker who successfully exploits this vulnerability could execute arbitrary code on the target system. Because the flaw occurs before authentication and requires no user interaction, it is classified as "wormable," meaning it could spread across networks similarly to WannaCry.
## Exploitation
- **Status:** Exploited in the wild; Public PoC (Proof of Concept) available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (High)
- **Integrity:** Total (High)
- **Availability:** Total (High)
## Remediation
### Patches
- **Microsoft:** Install security updates for CVE-2019-0708. Microsoft provided patches for both supported and "out-of-support" systems (XP/2003).
- **Siemens Healthineers:** Users are advised to contact the Siemens Healthineers service desk to receive specific patch instructions and validated updates for medical imaging equipment.
### Workarounds
- **Disable RDP:** If Remote Desktop Services are not required, disable the service entirely.
- **Enable NLA:** Enable Network Level Authentication (NLA) on systems running supported versions of Windows. This forces the attacker to have a valid account to exploit the flaw.
- **Block Port 3389:** Block Transmission Control Protocol (TCP) port 3389 at the enterprise firewall to prevent external access.
## Detection
- **Indicators of compromise:** Look for unauthorized RDP sessions or unusual system crashes (BSOD) related to `termdd.sys`.
- **Detection methods and tools:**
- Vulnerability scanners (Nessus, Qualys) have specific plugins to detect missing patches for CVE-2019-0708.
- Monitor network traffic for anomalous RDP handshake sequences on port 3389.
## References
- **Siemens Healthineers Advisory:** hxxps[://]www[.]siemens-healthineers[.]com/support-documentation/cybersecurity
- **Microsoft Security Update Guide:** hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2019-0708
- **CISA Alert (AA19-168A):** hxxps[://]www[.]cisa[.]gov/news-events/alerts/2019/06/17/cisa-releases-code-determine-exposure-bluekeep-vulnerability