Author Archives: JimC_Security

Mitigating August’s Remote Desktop Services (RDS) Vulnerabilities

Earlier last week Microsoft released security updates for Remote Desktop Services (RDS).

If you use  Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions, please install the security updates for August 2019 which include fixes to these vulnerabilities: CVE-2019-1181 and CVE-2019-1182

Why should these vulnerabilities be considered important?
The following two vulnerabilities CVE-2019-1181 and CVE-2019-1182 have received a CVSS 3 base score (defined) of 9.8 and have the potential to be used by network worms to rapidly spread without the need for assistance from computer users. There is the potential for a repeat of an attack very similar to the WannaCry ransomware outbreak of May 2017.

How can I protect my organisation or myself from these vulnerabilities?
The most effective means of defence is to install the updates released by Microsoft available via Windows Update (this link provides guidance on doing so) or manually from the above links.

While the BlueKeep vulnerability has not yet been exploited, there are indications (here and here) it may be soon. These more recent vulnerabilities will likely receive similar or more interest since they are present in more versions of Windows (8.1 and 10 alongside their Server based equivalents) than BlueKeep.

If for any reason this is not possible, the mitigations listed in this Microsoft blog post will be useful. Thank you.

August 2019 Update Summary

Update: 13th August 2019
Earlier today Adobe and Microsoft released large collections of security updates. They resolve 119 and 93 vulnerabilities (respectively).

Adobe After Effects: 1x Priority 3 vulnerability resolved (Important severity)

Adobe Character Animator: 1x Priority 3 vulnerability resolved (Important severity)

Adobe Premiere Pro CC: 1x Priority 3 vulnerability resolved (Important severity)

Adobe Prelude CC: 1x Priority 3 vulnerability resolved (Important severity)

Adobe Creative Cloud Application: 4x Priority 2 vulnerabilities resolved (2x Critical and 2 Important severity)

Adobe Acrobat and Reader: 76x Priority 2 vulnerabilities resolved (76x Important severity)

Adobe Experience Manager:1x priority 1 vulnerability resolved (1x Critical severity)

Adobe Photoshop CC: 34x priority 3 vulnerabilities resolved (22x Critical and 12x Important)

If you use any of these Adobe products, please apply the necessary updates as soon as possible especially for Adobe Acrobat/Reader, Photoshop CC and Experience Manager

This month’s list of Known Issues from Microsoft is available within their monthly summary page and applies to all currently supported operating systems. Not all issues have workarounds at this time. The up to date list is available from their summary page. For Windows 7, for customers with Symantec Antivirus or Norton Antivirus, a hold has been put on the updates from being offered in Windows Updates due to ”The Windows updates are blocked or deleted by the antivirus program during installation, which may then cause Windows to stop working or fail to start”. The Symantec article linked to at this time is a blank template.

US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

A further useful source of update related information is the Calendar of Updates.

News/announcements of updates in the categories of General SoftwareSecurity Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by donating.

For this month’s Microsoft updates, I will prioritize the order of installation below:
Microsoft Remote Desktop Services (RDS):  CVE-2019-1181 CVE-2019-1182  CVE-2019-1222, and CVE-2019-1226

Microsoft Graphics Component CVE-2019-1144  CVE-2019-1152  CVE-2019-1150 CVE-2019-1145 CVE-2019-1149

Microsoft Word CVE-2019-1201 CVE-2019-1205

Microsoft Outlook CVE-2019-1200 CVE-2019-1199

Scripting Engine CVE-2019-1133

Chakra Scripting Engine CVE-2019-1141 CVE-2019-1131 CVE-2019-1196 CVE-2019-1197 CVE-2019-1140 CVE-2019-1139

LNK Remote Code Execution Vulnerability CVE-2019-1188

Windows DHCP Client CVE-2019-0736 CVE-2019-1213

Windows Hyper-V CVE-2019-0720 CVE-2019-0965

Windows VBScript Engine CVE-2019-1183


Please install the remaining updates at your earliest convenience.

As per standard best practice; I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

I have provided further details of updates available for other commonly used applications below.

Thank you.

VMware earlier this month released a security advisory to resolve 2 Important severity vulnerabilities within the following products:

VMware vSphere ESXi (ESXi)
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)

An attacker could leverage the vulnerability CVE-201-5521 (from the above linked to advisory) to also exploit CVE-2019-5684 to exploit Nvidia’s GPU driver (see below) to gain arbitrary code execution on a system.

If you use the above VMware products particularly with a Nvidia GPU, please review the advisory and apply the necessary updates.

Nvidia late last week issued a related security advisory to that of the above VMware advisory. Nvidia’s advisory resolves 5 locally exploitable vulnerabilities meaning that an attacker would first need to compromise your system before exploiting the vulnerabilities to elevate their privileges (defined). The steps to install the drivers are located here. If you use affected Nvidia graphics cards, please consider updating your drivers (defined) to the most recent available.

Canon Digital Cameras PTP (Picture Transfer Protocol) Vulnerabilities
Canon digital cameras utilising this protocol are potentially vulnerable to a complete takeover of the device while connected to a host PC or a hijacked mobile device.

As per this Canon advisory, please ensure your camera is using the most recent firmware update and that you follow the workarounds listed in the above advisory.

Software Updates for HP , Lexmark, Kyocera , Brother , Ricoh and Xerox Printers
The following links details the vulnerabilities found by security researchers within these printers and link to the relevant software updates:






Xerox (PDF)

Security Updates for Corporate and Consumer 4G Modems
G Richter a security researcher from Pen Test Partners disclosed the following vulnerabilities during DEF CON:

Netgear Nighthawk M1 Mobile router (currently no vendor advisory):
Cross-site request forgery (CSRF)(defined) bypass: CVE-2019-14526
Post-authentication command injection: CVE-2019-14527

TP-Link’s M7350 4G LTE Mobile wireless router (currently no vendor advisory):
CVE-2019-12103 – Pre-Authentication Command Execution
CVE-2019-12104 – Post-Authentication Command Execution

MF910 and MF65+ Advisory

MF920 Advisory

HTTP/2 Vulnerabilities
8 HTTP/2 DoS (defined) vulnerabilities have been responsibly disclosed by Netflix and Google. According to CloudFlare these vulnerabilities are already being exploited “We have detected and mitigated a handful of attacks but nothing widespread yet”.

Please review the affected vendors matrix within the following CERT advisory and apply the necessary updates:

Further information

Thank you.

Mitigating the Intel SWAPGS Vulnerability

This is medium severity information disclosure vulnerability. An attacker must already have compromised a system to exploit it. Patches from Red Hat, Google and Microsoft are available. Apple hardware does not appear to be affected.

If we look back 2 weeks we saw the disclosure of a vulnerability relating to VideoLAN VLC being performed incorrectly. This week there is an example of how responsible disclosure should be carried out and demonstrates it can work very well.

Red Hat Linux, Google and Microsoft have all issued patches for a newly discovered variant of the original Spectre v1 vulnerability (initially disclosed in January 2018).

The performance impact of the updates is described in the Red Hat advisory in more detail:

The fix for this CVE has shown to cause a minimal performance impact. The impact will be felt more in applications with high rates of user-kernel-user space transitions. For example, in system calls, NMIs, and kernel interrupts.

Early benchmarks for this mitigation show approximately 1% performance penalty:

How does this vulnerability work?
When building a memory address to access computer make use of segment registers (CS, DS, SS, ES, FS, GS). The FS and GS registers are used when the CPU (defined) is in 64-bit mode. The SWAPGS instruction is used on 64-bit entry into kernel code to swap the current user space value of GS with the value intended to be used during kernel operations. GS is used to access kernel data, but it does not validate the values it uses. There are checks during instruction execution to check if a swap to kernel mode is necessary. It is possible for the speculative execution process (attempting to look ahead to improve performance) to mis-judge if a swap is necessary  resulting in a small window of time where the wrong GS is used for memory access leading to disclosure of privileged information.

How can I protect my organisation and myself from this vulnerability?
Earlier this week Red Hat and Google released updates to resolve this vulnerability. Microsoft issued their update silently on 9th July:

Red Hat Linux

Google Chrome OS

Microsoft Windows

Thank you.

IBM Creates “Warshipping” Proof of Concept Device

Earlier this year I detailed a new method for an attacker to compromise an organisation by means of a modified smartphone charging cable. Today we see another method to compromise an organisation using an even more common means; the postal mail.

Why should this attack method be considered important?
Virtually every organisation receives postal mail with packages being commonplace. An attacker could send an anonymous package with one of the devices the IBM X-Force team created. The device was a small motherboard (defined) with 3G, WiFi and GPS built-in. It can be activated remotely over the internet and report its position via GPS and then instructed to scan for vulnerable network devices to attack.

It’s used to obtain the credentials of a corporate WiFi network. Once complete the device seeks to pivot using other vulnerable devices on the network to eventually compromise the network (also achieving persistence) and exfiltrate data or any other action of the attacker’s choice.

An attacker no longer needs to scout premises before trying to infiltrate it. They can just send a parcel to do it for them.

How can I protect my organisation or myself from this?
For an organisation; you can prohibit employees from having personal packages shipped to their office. A much more rigorous and expensive option which is unlikely to be favoured would be to scan all deliveries with an RF scanner.

Other suggestions to counter this device are detailed in IBM’s blog post.

Thank you.

Wind River Resolves Critical Infrastructure Vulnerabilities

Last week the real-time embedded systems vendor Wind River Systems released security updates for a large number of critical infrastructure systems.

If any of your enterprise clients use within their network perimeter: modems, routers, firewalls, printers, industrial control or medical monitoring devices; check if any of those devices use Wind River’s VxWorks software based on their TP/IP stack (IPnet). If so, review the FAQs and security advisory linked to below to install the necessary updates.

Why should these vulnerabilities be considered important?
The sheer number of affected devices is thought to be very large due to the prevalence of devices running the vulnerable VxWorks software. I realize the list of devices above is very generic but the FAQs and security advisory are not vendor or model specific. This means you may have some of these devices and not even realize it. Verifying if they are using VxWorks and what version will be a priority.

Since medical monitoring and industrial control devices are included in this advisory; if these vulnerabilities are exploited there is the potential for a threat to human life. E.g. if incorrect results are displayed on a medical device, too much medication is administered, or if temperatures exceed safe levels in an industrial control system.

Due to the nature of four of the vulnerabilities; a border firewall will not always be enough to prevent an attacker exploiting. Broadcast packets could be sent to every device in the network, compromising them all at once.

How can I protect my organization from these vulnerabilities?
Review the FAQs and the security advisory and take the necessary steps to install the relevant patches. If your organisation is affected; first apply the necessary mitigations to any vulnerable device you initially discover while you assess the remaining number of impacted devices and develop a plan/schedule to approach the installation of the patches:

Mitigations listed on Page 3 (onwards) of this security advisory:


From my understanding of the information provided by Wind River they are directly contacting their affected clients and may offer paid for assistance to resolve these vulnerabilities for out of support devices. However, there is a possibility they may inadvertently miss an affected organisation. Please contact Wind River if in doubt:

Thank you.

Wind River’s Blog Post:

Kaspersky ThreatPost article:

When vulnerability disclosure goes wrong

4 weeks ago saw the report of a new critical vulnerability in the widely used VideoLAN VLC Media Player. At the time no fix was available.

Earlier today; key developers from VideoLAN analysed the bug report and found that the exploit simply causes a memory leak which does not always crash the player. At no time was this behaviour exploitable by an attacker; it was simply a non-security code issue.

After further analysis it was determined the issue lay within a 3rd party library, libebml. Version 1.3.6 resolves the issue reported and was shipped with VLC version 3.0.3 (in May 2018). The release notes from that time state “Numerous 3rd party libraries updated, fixing security issues”

The above bug report was interesting since numerous technology news websites and even CERTs had incorrectly warned of the vulnerability and that a fix was 60% complete (unknown how that figure was obtained).

It demonstrates how quickly the report of an issue can spread long before anyone has worked on it and verified its legitimacy. After analysis by key VLC developers; there wasn’t an issue at all in updated versions of VLC.

This is really unfair to VideoLAN. They received a lot of negative press for an issue that wasn’t their fault. The truth of the matter is; nobody checked the claims of the person disclosing it before going to the media and the original reporter of the vulnerability disclosed it on a public forum rather than a private disclosure to VideoLAN.

Today demonstrates how NOT to disclose a vulnerability.

Please find the link to the bug report below and the full details provided by VideoLAN on their Twitter account as well further background information:

Thank you.

Logitech Unifying Receiver Vulnerabilities

Update: 12th August 2019
When the updates from Logitech are available; the links will be placed within the following forum thread:

Original Post
Earlier this week a security researcher responsibly disclosed 4 new vulnerabilities within Logitech products that use the USB Unifying receiver (a small black dongle with an orange star on it).

An attacker would need to be within range of the Unifying receiver (approx. 30 metres) to exploit some of these vulnerabilities. Others require physical access. Due to compatibility reasons; Logitech will only be patching 2 of these vulnerabilities in August 2019. To remain secure, you will need to physically secure (see the FAQ linked to below for specifics) the presentation clicker, mouse or keyboard from an attacker or use a wired keyboard or mouse.

Why should these vulnerabilities be considered important?
Before discussing the results of successfully exploiting these vulnerabilities; for an attacker to exploit these vulnerabilities they first either need to be nearby (approximately 30 metres) or to have physical access to your Logitech Unifying receiver (sometimes for a very short time) and preferably the device connected to it too.

The researchers GitHub page discusses all of the vulnerabilities (numbered 1 to 7).

Vulnerability 1 and vulnerability 7 don’t require physical access to the Logitech receiver or device but would require that the attacker is nearby (approximately 30 metres).

Vulnerability 4 needs physical access for some of the exploit to work. Using these vulnerabilities an attacker could inject arbitrary keystrokes into an affected receiver (leading to remote code execution), decrypt keyboard input and force a new device of the attacker’s choice to enter keystrokes which are sent to your system.


Affects of exploiting:

Vulnerability 1: keystroke injection

Vulnerability 2: keystroke injection Patched in 2016 (see my original post on this)

Vulnerability 3: keystroke injection

Vulnerability 4: keystroke injection and disclosure of the per-device link-encryption keys (the attacker could decrypt the data being sent between the receiver and the device)

Vulnerability 5: same as 4

Vulnerability 6: smaller scale keystroke injection and disclosure of link encryption keys of all paired devices

Vulnerability 7: Forced pairing of a device of the attacker’s choice to use for keystroke injection


How can I protect my organisation or myself from these vulnerabilities?
If your device offers a Bluetooth connection, switch to using it rather using the USB dongle. However this workaround is not without potential drawbacks. Nothing is ever totally secure but Bluetooth has had some notable vulnerabilities in recent years (BlueBorne, side channel attacks (defined) and BleedingBit).

If you have not already done so; check if an update is available for your Logitech Unifying receiver (the USB dongle) that were released in 2016. My post written back in 2016 provides all of the details to update affected devices.

Of the 4 remaining vulnerabilities disclosed this week; only 2 will be patched by Logitech. If they were to fix all 4 this would result in compatibility issues between the device and the receivers.

Please refer to the security researchers GitHub page frequently as further details and notifications of updates will be placed there.

According to (a German website); I have Google Translated the section detailing how to physically secure your Logitech devices to protect against this:

“The necessary protective measures make it particularly difficult to work in a professional environment, as it can often not be guaranteed that no unauthorized persons can access the USB receiver, which is usually located in the back of the computer. An attacker only needs an unobserved moment and a few seconds to access the receiver in order to permanently attack the radio connection from a distance. If you want to be on the safe side, you should better take the Unifying receiver off the computer and take it with you. Basically one should ask yourself the question, if it has to be a wireless keyboard or mouse at all. Because the safest thing is still a cable connection.”

Copyright © 2019 Heise Media

My sincere thanks to Heise for this very useful explanation.

The other remaining and possibly the easiest method to remain fully secure is to use a wired keyboard and mouse but I realise for laptop users or those who use presentation clickers this really isn’t an option.

I own a lot of Logitech wireless mice; all with the Unifying receiver. I patched them all back in 2016. I will be patching them again as soon as possible and taking the receivers with me when away from my systems (not sure how I will tell which is which but I will come up with some means of telling them apart).

Thank you.