Microsoft patches two new BlueKeep-like bugs
Microsoft has issued a set of fixes for two critical remote code execution vulnerabilities with characteristics similar to the high-profile BlueKeep vulnerability.
Like the original BlueKeep vulnerability, the two newly discovered vulnerabilities are wormable, meaning that malware using these exploits could propagate between computers without any user interaction required.
Also like BlueKeep, both new vulnerabilities exist within the Remote Desktop Services component of affected versions of Windows.
They could allow an authenticated attacker to connect to a target system using Remote Desktop Protocol and send specially crafted requests that could allow them to install programs; view, change, or delete data; or create new accounts with full user rights.
But unlike BlueKeep, the new vulnerabilities impact newer operating systems, including all supported versions of Windows 10.
Also unlike BlueKeep, obsolete operating systems such as Windows XP are not affected, alleviating Microsoft of the need to release another emergency patch for the out of support operating systems.
Microsoft said the company discovered the vulnerabilities themselves as part of its continual efforts to strengthen the security of its products, and that it has no evidence at this time that these vulnerabilities were known to any third party.
Implementing Network Level Authentication acts as a partial mitigation, but affected systems are still vulnerable to remote code execution exploitation if an attacker has managed to secure valid credentials.
Microsoft’s disclosure came shortly after the Australian Signals Directorate issued a security alert warning that a potential exploit has been developed for the original BlueKeep vulnerability and been disclosed to Metasploit.
The vulnerabilities were two of 93 vulnerabilities patched during this month’s Patch Tuesday security update releases.
These included 27 other critical vulnerabilities, including two other remote code execution flaws in the remote desktop services component of Windows. There were also 23 other remote code execution vulnerabilities in various components including Outlook, Word and the Chakra and VBScript scripting engines.
Please follow us and share on Twitter and Facebook. You can also subscribe for FREE to our weekly newsletter and quarterly magazine.
CrowdStrike to buy Adaptive Shield
CrowdStrike is augmenting its SaaS security capabilities through the acquisition of Israeli-based...
LockBit named nastiest malware of 2024
LockBit, a ransomware malware known to have been used to attack Australian targets, has been...
Extreme Networks launches ZTNA solution
Extreme Networks' new ExtremeCloud Universal ZTNA solution combines cloud network access...
