Microsoft patches two new BlueKeep-like bugs
Microsoft has issued a set of fixes for two critical remote code execution vulnerabilities with characteristics similar to the high-profile BlueKeep vulnerability.
Like the original BlueKeep vulnerability, the two newly discovered vulnerabilities are wormable, meaning that malware using these exploits could propagate between computers without any user interaction required.
Also like BlueKeep, both new vulnerabilities exist within the Remote Desktop Services component of affected versions of Windows.
They could allow an authenticated attacker to connect to a target system using Remote Desktop Protocol and send specially crafted requests that could allow them to install programs; view, change, or delete data; or create new accounts with full user rights.
But unlike BlueKeep, the new vulnerabilities impact newer operating systems, including all supported versions of Windows 10.
Also unlike BlueKeep, obsolete operating systems such as Windows XP are not affected, alleviating Microsoft of the need to release another emergency patch for the out of support operating systems.
Microsoft said the company discovered the vulnerabilities themselves as part of its continual efforts to strengthen the security of its products, and that it has no evidence at this time that these vulnerabilities were known to any third party.
Implementing Network Level Authentication acts as a partial mitigation, but affected systems are still vulnerable to remote code execution exploitation if an attacker has managed to secure valid credentials.
Microsoft’s disclosure came shortly after the Australian Signals Directorate issued a security alert warning that a potential exploit has been developed for the original BlueKeep vulnerability and been disclosed to Metasploit.
The vulnerabilities were two of 93 vulnerabilities patched during this month’s Patch Tuesday security update releases.
These included 27 other critical vulnerabilities, including two other remote code execution flaws in the remote desktop services component of Windows. There were also 23 other remote code execution vulnerabilities in various components including Outlook, Word and the Chakra and VBScript scripting engines.
Please follow us and share on Twitter and Facebook. You can also subscribe for FREE to our weekly newsletter and quarterly magazine.
Check Point and Illumio team up to counter AI threats
Check Point and Illumio have announced an expanded partnership aimed at helping organisations...
Cohesity develops headless data security architecture
Cohesity's Maestro solution is the first headless data security architecture for adding data...
Banking security leaders see AI as the industry's top threat
A survey of banking security leaders in 25 countries found that respondents overwhelmingly view...
