Microsoft Warns of New Wormable RDP Flaw


The monthly patch Tuesday security fixes was this week and Microsoft is warning Windows 10 users to update their operating system immediately because of two "critical" vulnerabilities.

Unlike the BlueKeep exploit, the CVE-2019-1181 and CVE-2019-1182 vulnerabilities don't apply to Windows XP, Windows Server 2003 and Windows 2008.

These new vulnerabilities, which Microsoft found while it was hardening RDS, can be exploited without user interaction by sending a specially-crafted remote desktop protocol (RDP) message to RDS. You can check out our overview of the updates if you have not done so already. That said, a patch for the vulnerability, named CVE-2019-1162, has now been made available but only for supported Windows releases.

Users of Remote Desktop Services are advised to apply the patch that was issued in May, and also to protect the system's Remote Desktop Protocol "listener".

Discovered by Google security researcher Tavis Ormandy, the vulnerability comes via the Windows CTF module. It was recently found that some versions of Windows are 'wormable, ' but a new patch can fix the issue.

With an estimation of exposing over 1 million Windows devices, BlueKeep (CVE-2019-0708) could be exploited by an attacker to perform remote code execution.

Jeffrey Epstein's NY jail was short-staffed
On Monday, Marlene Schiappa, France's gender equality minister, had demanded an investigation into Epstein's affairs in France. An autopsy was performed Sunday, but the city's chief medical examiner said investigators were awaiting further information.

Unlike the Bluekeep bug, these vulnerabilities are (slightly) less of a concern since the RDP feature is turned off by default on Windows 10. However, newer Windows products are affected.

You'd think that Notepad, the basic software that it is, is among the most innocuous among Windows' most popular apps.

Microsoft wasn't tipped about the flaw by anyone, but instead stumbled upon the vulnerability by itself, as it was looking to improve the security of the RDS package.

So if attackers can gain access to an unprivileged user on a system, they could then use an exploit to trigger a command to privileged processes, he added. "Successful exploitation would allow an attacker to perform actions on the system using the same permissions as the current user".

"We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators' access", the report quoted a Microsoft spokesperson as saying. Now, Windows Ink will link more directly to the Microsoft Whiteboard app, and also be able to perform a full-screen screen capture, or snip.