Exploit Module for BlueKeep (CVE-2019-0708) Released

The Threat
On Friday September 6^th, 2019, Metasploit added an exploit module for the vulnerability known as BlueKeep (CVE-2019-0708) [1]. Unlike the previous publicly released BlueKeep exploits, the recent release allows for remote-code execution. eSentire has not seen attacks in the wild at this time, but exploitation in the near future is almost certain due to this Metasploit release.

Companies that have not already applied the Microsoft security updates for CVE-2019-0708 should do so immediately. Companies that have already applied the security updates for CVE-2019-0708 are not affected by this release.

What we’re doing about it

• Updated Managed Vulnerability Service (MVS) plugins identify this vulnerability
• The Threat Intelligence team is monitoring this topic for additional information
• Detection methods for exploitation of CVE-2019-0708 are under evaluation

What you should do about it

• After performing a business impact review, apply the official Microsoft security updates to affected systems [2] [3]
• If RDP is not actively required, consider disabling the service or limiting access

Additional information

BlueKeep is a critical vulnerability affecting Microsoft Remote Desktop Services (RDS). If exploited, a remote and unauthenticated attacker can execute arbitrary code on vulnerable systems or cause a denial of service. User interaction is not required for successful exploitation.

Affected Windows Versions:

• Windows 7
• Windows Server 2008 R2 (various versions)
• Windows Server 2008 (various versions)

Affected Out-of-Support Versions:

• Windows XP (various versions)
• Windows Server 2003 (various versions)

References:

[1] https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/

[2] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

[3] https://support.microsoft.com/en-gb/help/4500705/customer-guidance-for-cve-2019-0708

[4] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

[5] https://support.microsoft.com/en-gb/help/4500705/customer-guidance-for-cve-2019-0708