Posted on 05/20/2019 5:30:49 PM PDT by dayglored
[dayglored's note: This is direct from the horse's mouth, Microsoft Technet. It's a bad one, like the WannaCry malware from a couple years ago.]
Today [May 14] Microsoft released fixes for a critical Remote Code Execution vulnerability, CVE-2019-0708, in Remote Desktop Services – formerly known as Terminal Services – that affects some older versions of Windows. The Remote Desktop Protocol (RDP) itself is not vulnerable. This vulnerability is pre-authentication and requires no user interaction. In other words, the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware.
Now that I have your attention, it is important that affected systems are patched as quickly as possible to prevent such a scenario from happening. In response, we are taking the unusual step of providing a security update for all customers to protect Windows platforms, including some out-of-support versions of Windows.
Vulnerable in-support systems include Windows 7, Windows Server 2008 R2, and Windows Server 2008. Downloads for in-support versions of Windows can be found in the Microsoft Security Update Guide. Customers who use an in-support version of Windows and have automatic updates enabled are automatically protected.
Out-of-support systems include Windows 2003 and Windows XP. If you are on an out-of-support version, the best way to address this vulnerability is to upgrade to the latest version of Windows. Even so, we are making fixes available for these out-of-support versions of Windows in KB4500705.
Customers running Windows 8 and Windows 10 are not affected by this vulnerability, and it is no coincidence that later versions of Windows are unaffected. Microsoft invests heavily in strengthening the security of its products, often through major architectural improvements that are not possible to backport to earlier versions of Windows.
There is partial mitigation on affected systems that have Network Level Authentication (NLA) enabled. The affected systems are mitigated against ‘wormable’ malware or advanced malware threats that could exploit the vulnerability, as NLA requires authentication before the vulnerability can be triggered. However, affected systems are still vulnerable to Remote Code Execution (RCE) exploitation if the attacker has valid credentials that can be used to successfully authenticate.
It is for these reasons that we strongly advise that all affected systems – irrespective of whether NLA is enabled or not – should be updated as soon as possible.
Resources
Links to downloads for Windows 7, Windows 2008 R2, and Windows 2008
Links to downloads for Windows 2003 and Windows XP
Simon Pope, Director of Incident Response, Microsoft Security Response Center (MSRC)
Not a chance. I dont windows update anything and refuse to buy into the mass hysteria. My computers run just fine with win 7 , bitchin vpn and security and good old fashion stay away from shitty websites I dont know.
In fact I have special software to block microsoft from even knowing I am running win 7. Nope let the chumps update themselves into ruining the only microsoft product worth having. Windows 10 can go yo hell. It sucks.
Well, without the update the software is still the vulnerable version, -BUT- you have it disabled, so it should be okay.
You mean like Hillary? (That was how her Windows private email server was configured. Seriously, look it up...)
I agree. I do not do updates, at all. I’ve turned off remote desktop.
No matter which one I download, Win-7 Pro x64 says “Windows can not open thi sfile”.
What should I do.
I have auto-update ON; am I covered?
bump to the top
BFLR
I believe it
That sounds like a case of remote desktop control via a program installed on your computer, such as "GoToMyPC", "TeamView", "Skype", "Hangouts", or similar (there are a bunch of them, some commercial, some freeware). Could even be a remote tech-support thing from some time in the past when you got support from a manufacturer or dealer.
I suggest you crawl through the machine's "Program Files" folders, looking for programs that allow communication between you and someone outside, that include "sharing" a desktop.
If there's nothing like that, you probably got infected with something that's accomplishing that remote control with a trojan of some sort. Get your anti-malware software in gear and scan...
ME too!
What about Vista?
It still sucks!
Microsoft stopped selling Vista in 2010, mainstream support ended in April 2012, and Microsoft dropped all support entirely in April 2017, over two years ago. The remaining active user base of Vista is so small -- less than half-a-percent of all Windows users -- that Microsoft simply doesn't care about them and wants them to go away. Vista users should have long since upgraded to Windows 7 or later.
It's dead, Jim.
I also turned off the Remote Service.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.