# MA-730.062019: MyCERT Advisory - Advisory related to RDP vulnerabilities aka BlueKeep (CVE-2019-0708)

**Date:** 01 Jun 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-730.062019  
**Advisory ID:** MA-730.062019

---

**1.0 Introduction**
MyCERT received information from valid resources about Remote Code Execution (RCE) vulnerability that was found in Remote Desktop Services (RDS). This vulnerability is rated critical and has been assigned CVE number; [CVE-2019-0708] will affect the following in-support and out-of-support operating systems:
- In-support systems: Windows 7, Windows Server 2008 R2, and Windows Server 2008
- Out-of-support systems: Windows 2003 and Windows XP
Due to that Microsoft issued a security fix designed to protect Windows computers running vulnerable RDS installations. Attackers could exploit this vulnerability by sending a specially crafted request to systems running RDS via Remote Desktop Services (RDP), tricking it into executing the arbitrary code. This vulnerability is pre-authentication and requires no user interaction. The exploit code also has the capability to propagate between unpatched machines.
**2.0 Impact**
Successful exploitation of this vulnerability could allow remote attackers to take control of an affected system and perform malicious activities, including modifying and installing programs; view, change, or delete data; or create new accounts with full user rights.
**3.0 Affected Products**
| In-support systems | Out-of-support systems | --- | --- | Windows 7, Windows Server 2008 R2,  and Windows Server 2008 | Windows 2003 and Windows XP |
**4.0 Recommendations**
MyCERT highly recommended users and administrators of affected products  to apply the security updates immediately.
- In-support systems : Windows 7, Windows Server 2008, and Windows Server 2008 R2
<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708>
- Out-of-support systems : Windows XP, Windows Server 2003
<https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708>
MyCERT also advise user to disable RDS if they do not need it as this reduces the attack surface exposure.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#593a203b3c2b606060193a203b3c2b2a3c3a2c2b302d20773420) or [[email protected]](/cdn-cgi/l/email-protection#acc1d5cfc9ded8ecc1d5cfc9ded882c3decb82c1d5)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <http://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
- <https://www.us-cert.gov/ncas/current-activity/2019/05/16/Microsoft-Releases-Security-Updates-Address-Remote-Code-Execution>
- <https://www.csa.gov.sg/singcert/news/advisories-alerts/microsoft-remote-desktop-services-remote-code-execution-vulnerability-cve-2019-0708>
- <https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in-windows-xp-7-and-windows-2003/>
- <https://blogs.technet.microsoft.com/msrc/2019/05/14/prevent-a-worm-by-updating-remote-desktop-services-cve-2019-0708/>
- <https://www.zdnet.com/article/almost-one-million-windows-systems-vulnerable-to-bluekeep-cve-2019-0708/>
- <https://www.bleepingcomputer.com/news/security/microsoft-warns-users-again-to-patch-wormable-bluekeep-flaw/>