BlueKeep RDP Vulnerability: How to Find Vulnerable Hosts and Apply Patches
Summary
BlueKeep can let unauthenticated attackers remotely execute code on unpatched Windows systems with RDS. Huntress describes affected hosts, Microsoft patches, and using RDPScan to identify vulnerable systems.
Key points
- Microsoft released patches for BlueKeep during its May 2019 patch cycle; the vulnerability affects Remote Desktop Services.
- The article says the flaw could enable remote, unauthenticated code execution with administrative privileges and potentially spread across a network.
- Robert Graham estimated nearly one million computers and servers might be vulnerable based on an external scan conducted on May 28, 2019.
- Huntress used RDPScan to check externally accessible hosts running Windows Vista, 7, Server 2008, and Server 2008 R2, then notified affected partners.
- Microsoft issued patches for supported Windows versions and older versions including Windows XP, Server 2003, and Vista; Huntress urged administrators to apply and verify them.
- RDPScan can test a local host with `rdpscan.exe localhost`; the article cautions that scans using some tools have been shown to crash hosts.
Article Details
- Vulnerability Types
- Remote code execution
- Affected Versions
- Windows Vista
- Windows 7
- Windows Server 2008
- Windows Server 2008 R2
- Windows XP
- Windows Server 2003
- Windows Server 2003 R2
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
People
Vendors
Products
Microsoft WindowsDuring Windows’ May 2019 patch cycle, Microsoft released a patch for a remote code execution bug in their Remote Desktop Services software. If left unpatched, this vulnerability could allow remote, unauthenticatedRemote Desktop ServicesRemote Desktop Services (RDS) benefit employees and IT administrators alike. With employees often working from anywhere, remote desktop reduces the physical burden of carrying a work laptop home 🏠. It also makes