Forum Discussion
Critical Remote Code Execution Vulnerability CVE-2019-0708...
Critical Remote Code Execution Vulnerability CVE-2019-0708 Addressed in Patch Tuesday Updates
Microsoft has released its monthly security update for May. Included in this month's Patch Tuesday release is CVE-2019-0708, a critical remote code execution vulnerability that could allow an unauthenticated remote attacker to execute remote code on a vulnerable target running Remote Desktop Protocol (RDP).
Tenable recommends applying the full May 2019 Security Update from Microsoft for all vulnerable assets. For CVE-2019-0708, Microsoft has provided updates for Windows 7, Windows Server 2008 and Windows Server 2008 R2. Additionally, Microsoft has provided patches for out-of-support systems, including Windows XP, Windows XP Professional, Windows XP Embedded and Windows Server 2003.
For more information, please visit our blog.
12 Replies
Good afternoon! A customer today raised an interesting question regarding scanning for this CVE. Will Nessus be able to scan devices susceptible/vulnerable to this vuln in particular if under NLA (Network Level Authentication), given that for the exploit on NLA to succeed an authentication is required - and so might the scan to detect it?
Our scan currently looks for the installed KB from the windows update, and doesn't include logic to look for the target's NLA configuration.
But! You can use plugin 58453 to see if NLA is enabled or not on your target. Microsoft does state though: "...affected systems are still vulnerable to Remote Code Execution (RCE) exploitation if the attacker has valid credentials that can be used to successfully authenticate. " This is true even if NLA is enabled.
We like to err on the side of caution, and even though NLA being enabled would make exploitation less likely, it doesn't completely mitigate the risk of attack, which is why we still want this plugin to notify customers that are unpatched.
Hello Ryan,
Just small clarification required on your comments.Do you mean to say that even after applying KB, Nessus will still show it as unpatched. If possible,could you please provide us the MS KB's to be applied.
Ryan can you tell us what KB the plugin 125313 Microsoft RDP RCE (CVE-2019-0708) (uncredentialed check) is looking for?
Are there any plugins being developed to detect CVE-2019-0708 remotely, without credentials?
Hello,
Yes, although we don't have an exact ETA for when development will be complete. This plugin search will automatically update with our remote check for CVE-2019-0708 once it's live.
If you go to https://www.tenable.com/plugins/search?q=cves%3A(%22cve-2019-0708%22)&sort=&page=1 and click on the plugins you will see that they are "Local" meaning they require credentials. Also, you will see additional plugins under dependencies. You will need to have those plugins enabled as well.
