Microsoft Windows up to XP SP3 Remote Desktop Service BlueKeep use after free

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Microsoft Windows 7 SP1/Server 2003 SP2/Server 2008 R2 SP1/Server 2008 SP2/XP SP3. This affects an unknown function of the component Remote Desktop Service. The manipulation leads to input validation. This vulnerability is documented as CVE-2019-0708. The attack can be initiated remotely. Additionally, an exploit exists. This vulnerability has a historic impact because of its background and how it was received. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows 7 SP1/Server 2003 SP2/Server 2008 R2 SP1/Server 2008 SP2/XP SP3 (Operating System) and classified as very critical. This issue affects an unknown functionality of the component Remote Desktop Service. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability.

The weakness was released 05/14/2019 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The public release was coordinated with Microsoft. The identification of this vulnerability is CVE-2019-0708. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/18/2025). Due to its background and reception, this vulnerability has a historic impact. The advisory points out:

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

A public exploit has been developed by Sean Dillon/Ryan Hanson (@zerosum0x0/@ryHanson) in Ruby/Metasploit and been published 5 months after the advisory. The exploit is available at exploit-db.com. It is declared as attacked. We expect the 0-day to have been worth approximately $25k-$100k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 91541 (Microsoft Windows Remote Desktop Services Remote Code Execution Vulnerability (BlueKeep) (unauthenticated check)). The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/03/2021 with a due date of 05/03/2022:

Apply updates per vendor instructions.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 35285.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47416). krebsonsecurity.com is providing further details. Entries connected to this vulnerability are available at VDB-134684 and VDB-134678. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1
• Server 2003 SP2
• Server 2008 R2 SP1
• Server 2008 SP2
• XP SP3

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion