Microsoft Fixes Critical Remote Desktop Flaw, Blocks Worm Malware

The update is shipped to Windows 10 version 1809

Windows 7 users should run Windows Update to get the patch, or go here for manual downloads if that doesn't work.

A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. The company is also backporting a patch for this vulnerability to versions that are no longer supported, such as Windows 2003 and XP. It affects older versions of Windows dating all the way back to Windows XP.

The vulnerability causing all the fuss is a flaw in Remote Desktop Services, which as the name implies lets you remotely control a far-off PC from a second PC.

There are 22 critical flaws this month, out of which no less than 18 affect browsers and scripting engines, with other 4 representing Remote Code Execution (RCE) vulnerabilities in key products like Remote Desktop and Word. It is wormable, meaning that it allows any malware exploiting the flaw to be able to spread from one vulnerable system to another. 'While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware. Those using out-of-support systems (like Windows 2003 and Windows XP), can download the KB4500705 update in which Microsoft has implemented the necessary security fixes. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system.

Microsoft advises that "all affected systems - irrespective of whether NLA is enabled or not - should be updated as soon as possible".

Keanu Reeves girlfriend: TRAGEDY that killed his girlfriend - and Keanu's touching tribute
Talking about the movie , Reeves said, the duo are trying to write a song to save the entire universe. Keanu Reeves had an incredibly thoughtful response when asked about his thoughts on death.

There are no public exploits for it yet and no indication that it's already being actively exploited.

However, the newly-discovered vulnerability is so serious that Microsoft is warning it could pave the way for another attack similar to WannaCry, which took over hundreds of thousands of Windows PCs across the world back in 2017.

For more on this, read our companion article dealing with the potential consequences, affected systems and mitigations for this remote, "wormable" Windows vulnerability.

In addition, a publicly disclosed vulnerability in Skype for Android (CVE-2019-0932) could enable an attacker to snoop on conversations without a victim's knowledge. "Some customers may have to disable Hyper-Threading (SMT) to fully address the risk from MDS vulnerabilities", Microsoft also warned.

In shared resource environments (such as exists in some cloud services configurations), these vulnerabilities could allow one virtual machine to improperly access information from another.

Related News:



Most liked

Former Rays favorites Ben and Julianna Zobrist reportedly headed for divorce
It is not known whether he is receiving his salary - $12MM this season, his final under contract in Chicago - during his absence. The 2016 World Series MVP is getting a divorce from his wife, Julianna Zobrist , after 14 years of marriage.

AEW confirms TV deal with Turner Network
Both parties issued a joint press release heralding the union, hours ahead of WarnerMedia's advertiser upfronts in New York City. World Championship Wrestling was the last wrestling on TNT , and it disappeared when the company was sold to WWE in 2001.

Nebraska farmer gruesomely saves his own life after getting stuck in equipment
He was released from rehab over the weekend but will need to wait until his leg is fully healed to be fitted for a prosthetic. He was rushed to a hospital and later airlifted to another hospital where his daughter works. "It is what it is", Kaser said.

Google to push new ads on its apps to snare shoppers
It appears that ads for Google Images and Discover are already rolling out, but the new ads in YouTube are "coming soon". According to Google , consumers expect useful, swipeable, and visual experiences from their ads.

Selena Gomez blasts social media as 'terrible' for her generation
Ishita had announced "new beginnings" post the break up with pictures from her get-together with friends. We have to say, Gomez is absolutely right about social media being a bittersweet entity at times.

2 rescued from scaffold near top of 50-story Oklahoma tower
The two men were stranded outside the 259-metre skyscraper for under an hour before being pulled to safety. The cause of the accident is now under investigation, according to Oklahoma City Fire Capt David Macy.

Help Coming on Blocking Scam Calls for Robocall-plagued US
People received about 60 incoming calls from 'unrecognized numbers or numbers not linked to a person in their contact list'. Allowing the default call-blocking could significantly increase development and consumer adoption of the tools, Pai said.

Moon's Shrinking May Be Causing Moonquakes
But most researchers thought the process of cooling was over, and the process that created faults ceased long ago. Other events such as meteorite impacts can produce quakes, but those would produce different seismic signatures.

'Super Mario Maker 2' has a story mode and online multiplayer
Four members of the " Super Mario Maker " community will compete in a variety of courses designed by the Nintendo Treehouse team. Unlike the original Super Mario Maker , the upcoming Switch iteration boasts several different online multiplayer modes.

France’s Macron, New Zealand’s Ardern host Paris summit against online extremism
It plans to extend other restrictions in the coming weeks, including preventing the same people from creating ads on Facebook. Many monitors maintain that, despite positive statements, the companies still need to get better at regulating content.

'Imperative' UK government strikes new EU Brexit deal by June
It played down suggestions that the party was considering abstaining in the first vote on the Bill. May has said she will step down once the first phase of Brexit is complete.

Black Mirror Season 5 Trailer: Miley Cyrus, Anthony Mackie Star
There is, however, a twist: this season of Black Mirror will apparently only feature three new episodes. At the end of December past year , Netflix released the interactive movie Black Mirror: Bandersnatch .

Bitcoin breaks past $8,000 to hit yet another 2019 price record
Readers are advised to do their own research before investing in Bitcoin or other cryptocurrencies. When trading opened on Monday, futures traded on CME opened 12% higher.

Eurovision Song Contest 2019: Madonna's performance at final in doubt
But according to the Jerusalem Post , Madonna is expected to arrive in Tel Aviv on Wednesday to begin rehearsals. Eurovision tradition holds that the winning nation hosts the following year's event.

Meghan Markle releases photo of baby Archie for Mother's Day
Meghan Markle no longer has to spend any of her own money on her day to day expenses. To clarify, it's not Mother's Day in the United Kingdom - that's generally in March.