Old versions of Windows get a new patch to stop WannaCry-style attacks

[BootinUp]

Old versions of Windows get a new patch to stop WannaCry-style attacks
This even includes Windows XP.

Microsoft is trying to head off another WannaCry-style malware outbreak before it starts. The software giant has released fixes for a Remote Desktop Services (aka Terminal Services) vulnerability that could allow "wormable" malware that spreads from computer to computer without requiring any user input. The exploit affects Windows 7, Windows Server 2008 R2 and older releases. Not surprisingly, Microsoft isn't taking any chances. While it's no longer officially supporting Windows XP and Windows Server 2003, it's patching both platforms to prevent ancient PCs (like those used in some business and government scenarios) from falling prey to attacks.


https://www.engadget.com/2019/05/14/windows-7-xp-rds-vulnerability/

[hlthe2b]

1. Bookmarked...

[sprinkleeninow]

2. Thx. Sent myself the link. n/t

[Eugene]

3. Update: Microsoft just posted an 'Update Now' message on its security blog.

Source: Forbes

Microsoft Issues 'Update Now' Warning To Windows Users

Davey Winder Contributor
Cybersecurity
I report and analyse breaking cybersecurity and privacy stories

-snip-

The warning, which reads almost as if Microsoft wrote it on bended knee, was posted on the Microsoft Security Response Center blog. Referring to the critical Remote Code Execution vulnerability, CVE-2019-0708, that has become better known as BlueKeep, Simon Pope, director of incident response at Microsoft, states that "Microsoft is confident that an exploit exists for this vulnerability." What's more, Pope says that such an exploit could "propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017." An internet-scale port scanner has already determined that there are at least 923,671 internet-facing machines which are vulnerable to BlueKeep on port 3389 which is used by the Microsoft Remote Desktop feature.

It is worth reading between the lines here, especially concerning that apparent confidence that a BlueKeep exploit exists. While it is not clear if Microsoft has intelligence that suggests active malware has been weaponized in this way, what we do know is that there is proof of concept (PoC) code available already. One BlueKeep demo on GitHub will crash a system that is vulnerable but does not execute the wormable threat that Microsoft is obviously so worried about. We also know, through the information security community on Twitter, that there are denial of service (DoS) exploits available, and that security researchers have been successful in developing wormable exploit code.

-snip-

Read more: https://www.forbes.com/sites/daveywinder/2019/06/01/microsoft-begs-windows-users-to-update-now-citing-wannacry-2-security-threat/