Using Firepower to defend against encrypted RDP attacks like Blue Keep
Summary: Cisco Talos released Snort rule SID 50137 to block exploitation of CVE-2019-0708, a wormable pre-authentication remote code execution flaw in Remote Desktop Protocol Services that Microsoft patched in May 2019. The rule works by blocking any RDP connection that attempts to use the "MS_T120" virtual channel, which clients are not expected to create and through which an unauthenticated attacker sends crafted data.
Bottom line: Because RDP clients can request a switch to TLS after the connection confirm packet, Firepower only inspects the virtual channel list in the encrypted case if TLS decryption is configured for RDP - without it, an attacker can exploit CVE-2019-0708 and deliver malware that spreads rapidly while staying undetected.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-0708
- Related
- CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021