This week the American National Security Agency (NSA) warned Microsoft Windows users in an advisory release to Patch Remote Desktop Services on Legacy Versions of Windows against BlueKeep. In the release, the NSA said that they have seen “devastating computer worms inflict damage on unpatched systems”.
They continued to say, cyber criminals are using code to target these vulnerabilities specifically and that the malicious software called CVE-2019-0708 – dubbed ‘BlueKeep’ – is a vulnerability in the Remote Desktop (RDP) protocol. It is present in Windows 7, Windows XP, Server 2003 and 2008, and although Microsoft has issued a patch, potentially millions of machines are still vulnerable.”
This follows on from a blog by Simon Pope, Director of Incident Response, Microsoft Security Response Center (MSRC), titled Reminder to Update Your Systems to Prevent a Worm, published at the end of May. In it, he states that Microsoft has “released fixes for a critical Remote Code Execution vulnerability, CVE-2019-0708, in Remote Desktop Services – formerly known as Terminal Services – that affects some older versions of Windows.”
Microsoft emphasises that “nearly one million computers connected directly to the internet are still vulnerable to CVE-2019-0708. Many more within corporate networks may also be vulnerable.” Although it has been only “two weeks since the fix was released and there has been no sign of a worm yet. This does not mean that we’re out of the woods. If we look at the events leading up to the start of the WannaCry attacks, they serve to inform the risks of not applying fixes for this vulnerability in a timely manner,” says Microsoft.
It is strongly advised that all affected systems should be updated as soon as possible.
Windows updates available
Running unsupported Windows software comes at a risk, not only for the infected machine but for the whole network it is connected to and further afield. Microsoft has published these CVE-2019-0708 specific security updates for versions of Windows that no longer receive mainstream support.
End of support
These announcements should come as a timely reminder about the effects and risks of running unsupported software which can leave your organisation open to cyber-attack, data theft and increased costs. Four key Microsoft products are reaching their end of support lifecycles. Organisations must take steps to upgrade to a supported version (cloud-based or on-premise) or purchase further extended security updates (if available).
You can read more on extended security updates for SQL 2008/R2 here and extended security updates for Windows 7 here.
Our FREE End of Support report details available software upgrade options, including information on licensing agreements and subscriptions. The guide covers:
||9 July 2019
||SQL Server 2017 or SQL on Azure
||14 January 2020
|Windows Server 2008
||14 January 2020
||Windows Server 2016 or Windows Server on Azure
||13 October 2020
||Office 2019 or Office 365