Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
Summary: Microsoft released security updates for unsupported Windows XP and Windows 2003, along with supported Windows 7, Windows Server 2008 R2 and Windows Server 2008, to address CVE-2019-0708, a pre-authentication, no-user-interaction flaw in Remote Desktop Services that Microsoft calls wormable. Microsoft said it has observed no exploitation but expects malicious actors to write an exploit, comparing the potential spread to WannaCry, which Europol estimated hit some 200,000 computers across 150 countries in May 2017.
What you should know: A pre-authentication, no-click flaw in Remote Desktop Services means any future exploit could propagate machine to machine the way WannaCry did across 200,000 systems in 150 countries, and Microsoft is patching operating systems it stopped supporting years ago because those machines are still reachable.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-0708CVE-2019-0863
- Related
- CVE-2019-0863: Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021