Unit 42 Presents New Research at Blue Hat Seattle on Three New Windows RDP Vulnerability Exploit Methods
Summary: Unit 42 researchers Tao Yan and Jin Chen presented at Microsoft's invitation-only BlueHat Seattle 2019 conference on three new Windows RDP vulnerability exploitation methods using Pool Feng Shui, a technique that manipulates kernel pool layout and state to facilitate arbitrary code execution. Yan demonstrated the Bitmap Cache PDU, Refresh Rect PDU and RDPDR Client Name Request PDU techniques live against the wormable BlueKeep RDS Remote Code Execution Vulnerability (CVE-2019-0708), and attendees dubbed the closed-door session the "Best Talk of BlueHat."
What you should know: The techniques were demonstrated against BlueKeep, a wormable RDS flaw, and the researchers state that mitigating them can reduce the chance not only of BlueKeep exploitation but of other Windows RDP vulnerabilities being exploited successfully.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-0708
- Related
- CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021