Exploitation of Windows CVE-2019-0708 (Blue Keep): Three Ways to Write Data into Kernel with RDP PDU
Summary: Microsoft released an out-of-band patch in May 2019 for CVE-2019-0708, known as BlueKeep, a pre-authentication remote code execution vulnerability in Remote Desktop Services that requires no user interaction and can execute arbitrary code with system privileges; Microsoft also issued a patch for unsupported Windows XP. Unit 42 researchers analyzed the RDP internals and described how the Bitmap Cache PDU, Refresh Rect PDU, and RDPDR Client Name Request PDU can be used to write data into kernel memory, noting that a working exploit is only a matter of time.
Bottom line: The flaw is pre-authentication, needs no user interaction, and Microsoft's advisory says it may be wormable, the behavior seen in WannaCry and EsteemAudit - so any unpatched RDP host is exposed before anyone logs in.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-0708
- Related
- CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021