topic Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature in Advanced Threat Prevention Discussions

CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

Paul_Stinson — Wed, 15 May 2019 02:38:17 GMT

Hi,

just wondering on expected release for signature for this Vulnerability?

CVE-2019-0708 - Remote Desktop Services Remote Code Execution Vulnerability

Details here:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

regards

Paul

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

Ankit_Rai — Wed, 15 May 2019 15:04:41 GMT

Hi Guys,

Any idea, by when we have signatures for this CVE ?

CVE-2019-0708

@Paul_Stinson wrote:
Hi,
just wondering on expected release for signature for this Vulnerability?

CVE-2019-0708 - Remote Desktop Services Remote Code Execution Vulnerability

Details here:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

regards

Paul

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

SinOPtik — Thu, 16 May 2019 11:48:09 GMT

hey,

got an response from TAC:

Regarding Microsoft CVE-2019-0708, PA has investigated a feasibility of network-based vulnerability signature coverage and so far there is no known exploitation of this CVE to possibly create a coverage signature at this time. PA will continue observe should there is any change with regards to this CVE. As per Microsoft advisory a software update fix is currently available for any impacted version of Windows.

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

Paul_Stinson — Fri, 17 May 2019 03:11:15 GMT

Cheers thanks for the update.....interesting that there is a patch to patch the vulnerability but a signature can't be created for the vulnerability! 😉

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

matthewroberson — Mon, 20 May 2019 19:49:23 GMT

Is Palo Alto at least looking into creating a signature? TippingPoint has one and Cisco Talos is looking into creating a Snort rule.

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

SeanBallard — Tue, 21 May 2019 13:43:10 GMT

Snort sigs are live for this as of last night -

https://blog.snort.org/2019/05/snort-rule-update-for-may-20-2019.html

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

A.Waitkus — Tue, 21 May 2019 19:26:49 GMT

The signatures dont specifically detect CVE-2019-0708 they were developed to help identify "emerging threats"

I have just been informed that Palo Alto's Threat team has a working PoC and are developing a signature.

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

SeanBallard — Tue, 21 May 2019 19:29:52 GMT

Cisco and Checkpoint both have prevent signatures live right now. PAN is in field POC testing from what I am told and the signature should be GA here in a day or two.

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

ssullivan — Wed, 22 May 2019 00:11:21 GMT

Released in content 8154.

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

Paul_Stinson — Tue, 21 May 2019 23:56:09 GMT

TAC only Link?

Denied!

Re: CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

ssullivan — Wed, 22 May 2019 00:11:42 GMT

Sorry!
Released in content 8154.