topic Re: Traps CVE-2019-0708 in Advanced Threat Prevention Discussions

Traps CVE-2019-0708

JacobHusted — Thu, 16 May 2019 12:58:06 GMT

Does Traps offer protection against CVE-2019-0708 ?

Re: Traps CVE-2019-0708

BrandonWright — Fri, 17 May 2019 17:51:07 GMT

I've just opened a support case on this, I'll post when I hear back.

Re: Traps CVE-2019-0708

ChiragBhatt — Wed, 05 Jun 2019 06:43:33 GMT

Hi, Any reply from the Support team?

Re: Traps CVE-2019-0708

BrandonWright — Wed, 05 Jun 2019 16:28:08 GMT

Hello Chirag,

I did receive a response, but it wasn't completely definitive. At the time that I opened the case, there was no PoC code available for CVE-2019-0708, but the TAC engineer did research on the exploit and stated that it should be covered by Traps Default protections given his understanding of how the exploit works.

Now that there is exploit code available I plan on spinning up a windows VM with Traps to test this statement. I probably wont get to this until later this week.

Re: Traps CVE-2019-0708

ChiragBhatt — Thu, 06 Jun 2019 04:59:39 GMT

Thanks Brandon for sharing an update.

Please do share outcome from your test.

Cheers,

Re: Traps CVE-2019-0708

BrandonWright — Tue, 11 Jun 2019 01:26:46 GMT

Hello All,

So as of today, I was able to get some time to do some further testing. It looks like the default protection built-in to traps unfortunately doesn't seem to catch this. I'm still trying to determine if there is a configuration change (focusing on the Exploit Profiles) that will protect the process that is exploited as part of this CVE (CVE-2019-0708).

The testing methodology that I have used is as follows:

1. Spun up a Windows 7 VM, and fired a PoC Crash exploit at the unpatched system. This resulted in a Blue Screen and the machine cratched. Presumably if someone modifies this Blue Screen PoC code to get their own RCE (Remote Code Execution), then they could get their code executing on a system without a Blue Screen.

2. Next, I installed the latest Traps Agent on the Windows 7 VM, and rebooted. After the reboot, I fired the PoC crash exploit at the unpatched system yet again, and acheived the same result, with nothing being reported in the Traps Management Service.

I plan on opening another support ticket to inquire now that there is PoC code available. I'll post the results of that here later.

Thanks