Talos releases coverage for 'wormable' Microsoft vulnerability
Summary: Cisco Talos released a SNORT rule update, including rule 50137, covering CVE-2019-0708, a critical vulnerability in Remote Desktop Services that Microsoft disclosed the prior week in its monthly security update. The bug is pre-authentication and requires no user interaction, and Microsoft warned it is "wormable," meaning future malware exploiting it could spread from system to system, as WannaCry did in May 2017.
Key Takeaway: A pre-authentication, no-interaction flaw in Remote Desktop Services that Microsoft itself calls wormable is the same profile as WannaCry, which disabled major services across the globe in May 2017 - and exploitation only requires sending a specially crafted request over RDP.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-0708
- Related
- CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021