Update: 2019/5/31.

I’m adding this information as it’s just so critical

BlueKeep is a term for a security vulnerability (CVE–2019-0708) (noted as “critical” by Microsoft)^[1][2] affecting computers using older versions (Windows 8 and Windows 10 are not affected) of the Microsoft Windows operating system.^{[3][4][5][6][7][8][9][10][11][12]} As of May 2019, nearly one million computers may be at risk for the “wormable” BlueKeep Remote Desktop Services (RDS) Remote Code Execution (RCE) Remote Desktop Protocol (RDP) vulnerability.^[9][11] Microsoft considers the flaw “critical”, and recommends installing available update patches as soon as possible to affected systems to mitigate the vulnerability, as well as disabling Remote Desktop Services if they are not required.^[3][4]

The original post that I blogged on May 14th, 2019, is below.

Introduction

WannaCry was a disaster that could have been prevented if people took notice. If you didn’t hear about it you must have been asleep, here is a refresher.

After WannaCry, most businesses took notice and updated their operating systems, patched them and took measures to avoid a further outbreak. But today, May 14th, 2019, Microsoft has released information that warns of yet another WannaCry-like worm.

Note: If you are using Windows 10, you are OK, you are not vulnerable to this CVE. If not, and if you are still on Windows 7 then start upgrading to Windows 10 by using the Inplace Upgrade Task Sequence I explain about here or if you cannot upgrade immediately, then patch Windows 7 to protect it from this vulnerability.

Vulnerable in-support systems include Windows 7, Windows Server 2008 R2, and Windows Server 2008. Downloads for in-support versions of Windows can be found in the Microsoft Security Update Guide. Customers who use an in-support version of Windows and have automatic updates enabled are automatically protected.

Out-of-support systems include Windows 2003 and Windows XP. If you are on an out-of-support version, the best way to address this vulnerability is to upgrade to the latest version of Windows. Even so, we are making fixes available for these out-of-support versions of Windows in KB4500705.

If however you are running Windows XP, yes…. that old unsupported operating system then take warning !

Today, Microsoft has warned against the wormable capabilities from this CVE (critical Remote Code Execution vulnerability) and they blogged about what to do to avoid it happening to you.

Read that blog post here: https://blogs.technet.microsoft.com/msrc/2019/05/14/prevent-a-worm-by-updating-remote-desktop-services-cve-2019-0708/

It’s very clear from their text that this is all about protecting customers from the next worm, so pay attention and if you have old operating systems that are in support and affected, then update immediately.

Note: This is so serious that even Windows XP and Windows Server 2003 are getting updates from Microsoft for this vulnerability. You can download those updates from Microsoft Catalog here.

https://support.microsoft.com/en-ca/help/4500705/customer-guidance-for-cve-2019-0708

Update: The new vulnerability is now known as ‘BlueKeep‘ and Microsoft have stated…

It only takes one vulnerable computer connected to the internet to provide a potential gateway into these corporate networks, where advanced malware could spread, infecting computers across the enterprise.

Read more

• https://blogs.technet.microsoft.com/msrc/2019/05/30/a-reminder-to-update-your-systems-to-prevent-a-worm/
• https://arstechnica.com/information-technology/2019/05/microsoft-says-its-confident-an-exploit-exists-for-wormable-bluekeep-flaw/