CVE-2019-0708
Microsoft Windows
En bref
- Source
- NVD
- EPSS
- EPSS 100.00 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- microsoft
- Statut NVD
- Analyzed
Description
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
Faiblesses (CWE)
- CWE-416 — Utilisation après libération
Références
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
- https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en
- http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en
- http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html
- http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html
- http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html
- http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html
- http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-1468
- GCVE · GCVE-0-2019-0708
Avis du CERT-FR
- CERTFR-2019-AVI-553 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
- CERTFR-2019-AVI-311 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2019-AVI-240 — SCADA Vulnérabilité dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2019-AVI-223 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr
- CERTFR-2019-ALE-012 — Multiples vulnérabilités dans Microsoft Remote Desktop Services · cert.ssi.gouv.fr
- CERTFR-2019-ALE-006 — Vulnérabilité dans Microsoft Remote Desktop Services · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*cpe:2.3:o:siemens:axiom_multix_m_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:axiom_vertix_md_trauma_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:axiom_vertix_solitaire_m_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:mobilett_xp_digital_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_pro_acss_p_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_pro_p_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_pro_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_pro_acss_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_pro_navy_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_swing_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_top_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_top_acss_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_top_p_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:multix_top_acss_p_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:vertix_solitaire_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:atellica_solution_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:aptio_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:streamlab_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:centralink_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:viva_e_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:viva_twin_firmware:*:*:*:*:*:*:*:*cpe:2.3:a:siemens:syngo_lab_process_manager:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:rapidpoint_500_firmware:*:*:*:*:*:*:*:*≤ 2.3.2cpe:2.3:o:siemens:lantis_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c10:*:*:*:*:*:*:*cpe:2.3:o:huawei:bh620_v2_firmware:v100r002c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:bh621_v2_firmware:v100r002c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:bh622_v2_firmware:v100r001c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:bh640_v2_firmware:v100r002c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:ch121_firmware:v100r001c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:ch140_firmware:v100r001c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:ch220_firmware:v100r001c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:ch221_firmware:v100r001c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:ch222_firmware:v100r002c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:ch240_firmware:v100r001c00:*:*:*:*:*:*:*cpe:2.3:o:huawei:ch242_firmware:v100r001c00:*:*:*:*:*:*:*- +35 autres
Produits affectés
| Produit | Versions |
|---|---|
| Microsoft · Windows | affected 7 for 32-bit Systems Service Pack 1 ; affected 7 for x64-based Systems Service Pack 1 |
| Microsoft · Windows Server | affected 2008 R2 for x64-based Systems Service Pack 1 (Core installation) ; affected 2008 R2 for Itanium-Based Systems Service Pack 1 ; affected 2008 R2 for x64-based Systems Service Pack 1 ; affected 2008 for 32-bit Systems Service Pack 2 (Core installation) ; affected 2008 for Itanium-Based Systems Service Pack 2 ; affected 2008 for 32-bit Systems Service Pack 2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |