HomeWinBuzzer NewsMicrosoft Urges Users to Patch Against BlueKeep Windows Vulnerability

Microsoft Urges Users to Patch Against BlueKeep Windows Vulnerability

Microsoft says patches exist to protect legacy Windows from the BlueKeep flaw, which is in the wild and likely to be exploited soon.

-

Earlier this week, we reported on a Windows flaw that has left one million devices open to exploit despite issuing a patch. The so-called vulnerability affects legacy Windows versions. In response to the proof-of-concept (PoC) being published, Microsoft has issued a user warning.

The company is cautioning Windows to patch their older versions of Windows to protect against the vulnerability.

BlueKeep is a dangerous vulnerability because it can be executed by bad actors remotely. It is located in Remote Desktop Services on older Windows legacy builds such as Windows 7, Windows XP, AND Server 2003 and 2008.

“This [bug] would have the potential of a global WannaCry-level event,” said Chris Goettl, director of product management for security at Ivanti, during Patch Tuesday. “What's more, Microsoft has released updates for Windows XP and Server 2003 (which you wouldn't have found unless you were looking at the Windows Update Catalog). So, this affects Windows 7, Server 2008 R2, XP and Server 2003.”

Known as CVE-2019-0708 by Microsoft, the company says there is a good chance a exploit is in the wild for BlueKeep.

“Microsoft is confident that an exploit exists for this vulnerability, and if recent reports are accurate, nearly one million computers connected directly to the internet are still vulnerable to CVE-2019-0708,” said Simon Pope,?Director of Incident Response,?Microsoft Security Response Center (MSRC).

Attacks Incoming

Additionally, the company says it is only a matter of time before BlueKeep is leveraged in the form of a real attack. This is arguably not Microsoft's fault as patches are available to protect Windows XP, Windows Vista, Windows 7, Windows Server 2003, and Windows Server 2008 from the vulnerability. These are all the versions BlueKeep is known to be present in.

“Our recommendation remains the same. We strongly advise that all affected systems should be updated as soon as possible,” Pope said.

“It only takes one vulnerable computer connected to the internet to provide a potential gateway into […] corporate networks, where advanced malware could spread, infecting computers across the enterprise,” he said.

SourceMicrosoft
Luke Jones
Luke Jones
Luke has been writing about all things tech for more than five years. He is following Microsoft closely to bring you the latest news about Windows, Office, Azure, Skype, HoloLens and all the rest of their products.

Recent News