CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

[Paul_Stinson]

Hi,

just wondering on expected release for signature for this Vulnerability?

CVE-2019-0708  - Remote Desktop Services Remote Code Execution Vulnerability

Details here:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

regards

Paul

[Ankit_Rai]

Hi Guys,

Any idea, by when we have signatures for this CVE ?

CVE-2019-0708

---

@Paul_Stinson wrote:

Hi,

just wondering on expected release for signature for this Vulnerability?

CVE-2019-0708  - Remote Desktop Services Remote Code Execution Vulnerability

Details here:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

regards

Paul

---

[SinOPtik]

hey,

got an response from TAC:

Regarding Microsoft CVE-2019-0708, PA has investigated a feasibility of network-based vulnerability signature coverage and so far there is no known exploitation of this CVE to possibly create a coverage signature at this time. PA will continue observe should there is any change with regards to this CVE. As per Microsoft advisory a software update fix is currently available for any impacted version of Windows.

[Paul_Stinson]

Cheers thanks for the update.....interesting that there is a patch to patch the vulnerability but a signature can't be created for the vulnerability! 😉

[matthewroberson]

Is Palo Alto at least looking into creating a signature?  TippingPoint has one and Cisco Talos is looking into creating a Snort rule.

[SeanBallard]

Snort sigs are live for this as of last night -

https://blog.snort.org/2019/05/snort-rule-update-for-may-20-2019.html

[A.Waitkus]

The signatures dont specifically detect CVE-2019-0708 they were developed to help identify "emerging threats"

I have just been informed that Palo Alto's Threat team has a working PoC and are developing a signature. 

[SeanBallard]

Cisco and Checkpoint both have prevent signatures live right now. PAN is in field POC testing from what I am told and the signature should be GA here in a day or two. 

[ssullivan · Accepted solution]

Released in content 8154.

[Paul_Stinson]

TAC only Link?

Denied!

[ssullivan]

Sorry!
Released in content 8154.