topic Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability in Next-Generation Firewall Discussions

Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

RomainSalmon — Tue, 13 Aug 2024 13:15:29 GMT

Hello,

After installing the last content update (https://proditpdownloads.paloaltonetworks.com/content/content-8880-8907.html?__token__=exp=1724141521~acl=/content/content-8880-8907.html*~hmac=1db8a0453380feaed30e6acb96df65d1a9c07f4e7ebe53abb34ad3cffda87f9d)

I have a lot of traffic blocked from my servers to the licence microsoft server. But the licence servers get the patch from microsoft (CVE-2024-38077). Does anyone have the same problem ?

Other question more technical: I configured Ip address exemption (licence servers ) on my IPS profile with the 'alert' action for this signature. Could you confirm, if this signature match other servers, traffic will still be blocked?

Edit: I have found the answer for IP-address-exemptions behaviour,

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UscCAE

I opened a tac case as well.

Regards,

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Wijnand343 — Tue, 13 Aug 2024 09:20:30 GMT

Yes, we have the same issue!
We rolled back the update and disabled threat prevention update's as a temporary solution.
We also made a case with Palo Alto.
It looks like it also blocks none malicious traffic

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

RomainSalmon — Tue, 13 Aug 2024 09:11:59 GMT

Hello thanks for your reply. Concerning 'We rolled back the update and disabled threat prevention as a temporary solution.' : i cannot do this for securiy reasons, it's safer to disable only the signature if you want my opinion. If you have news from Palo Alto : i m all ears.

Regards,

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Wijnand343 — Tue, 13 Aug 2024 09:22:19 GMT

I will continue to work with you to answer your queries and provide the necessary technical assistance.

As per the case description, I understand that you updated the content version to 8880 and after that, you noticed the traffic stopped working, once reverted the issue is resolved.

Kindly note that content 8880 provided coverage for a critical remote code execution vulnerability CVE-2024-38077 on Windows https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077

The first thing to understand about vulnerability signatures is that these are just alerting you of any possible exploitation. They are only telling you that the firewall has detected a stream of traffic that matches a known signature for a vulnerability. It doesn't mean you have been exploited by someone.

Windows remote desktop licensing service is prone to a remote code execution vulnerability while parsing certain crafted DCE/RPC requests. The vulnerability is due to the lack of proper checks in DCE/RPC requests, leading to an exploitable remote code execution. An attacker could exploit the vulnerability by sending a crafted DCE/RPC request. A successful attack could lead to remote code execution

Can you please verify if the Remote Desktop Licensing Service is activated in your environment?

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Wijnand343 — Tue, 13 Aug 2024 09:27:09 GMT

Update:
As per the case description, I understand that you updated the content version to 8880 and after that, you noticed the traffic stopped working, once reverted the issue is resolved.

Kindly note that content 8880 provided coverage for a critical remote code execution vulnerability CVE-2024-38077 on Windows https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077

The first thing to understand about vulnerability signatures is that these are just alerting you of any possible exploitation. They are only telling you that the firewall has detected a stream of traffic that matches a known signature for a vulnerability. It doesn't mean you have been exploited by someone.

Windows remote desktop licensing service is prone to a remote code execution vulnerability while parsing certain crafted DCE/RPC requests. The vulnerability is due to the lack of proper checks in DCE/RPC requests, leading to an exploitable remote code execution. An attacker could exploit the vulnerability by sending a crafted DCE/RPC request. A successful attack could lead to remote code execution.

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Wijnand343 — Tue, 13 Aug 2024 09:30:06 GMT

Update:

Yes, we are seeing multiple internal reports with False positives, at this stage, we are reviewing the signature with engineering for a possible false positive.

I will keep you updated!

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

CSavoy — Tue, 13 Aug 2024 11:50:32 GMT

On our side we just put the "Vulnerability Protection" to None on the matching security policy, waiting now for the corrective patch from Palo Alto.

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

starki — Tue, 13 Aug 2024 12:41:34 GMT

You can set an Exception for ID 95501 in your Vulnerability Protection Profile and set the Action to "alert".

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

BrianClausen — Tue, 13 Aug 2024 12:53:36 GMT

same issues here. Did make an exception.

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

R.Ilves — Tue, 13 Aug 2024 13:13:49 GMT

Same issue, added exception for now

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

alix-c — Tue, 13 Aug 2024 15:16:35 GMT

Hello, You need to update your license server.
Palo updated their threat database :

Edit : I just saw, you installed the patch ..

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Tamas_Arato — Tue, 13 Aug 2024 18:42:33 GMT

It looks like this specific content update (8880-8907) has been withdrawn. It is no longer visible at the Dynamic Updates or downloadable from the Customer Portal.

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

RomainSalmon — Tue, 13 Aug 2024 20:36:26 GMT

Update : it's official they are working on it : Version 8881 - signature disabled to address a possible fp issue

Re: Alert ID 95501 Microsoft Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

mtwinam — Wed, 14 Aug 2024 14:49:30 GMT

looks like they resolved the issue as the exception added is now removed.