If you’re still using Windows XP or Windows Server 2003, you should download and install these patches right now. Before you start upgrading your drivers, make sure you back up your important information on the instance, or create an AMI from the instance. These patches are named KB4500331 and available on Microsoft’s Update Catalog website. For Windows Server 2008 R2 and later, we recommend you upgrade to AWS PV drivers that include the Guest Agent update. We recommend that customers running one of these operating systems download and install the update as soon as possible. These updates are available from the Microsoft Update Catalog only.
As Microsoft’s CVE-2019-0708 bulletin explains:
However, there’s a big problem: Windows Update won’t automatically install it on Windows XP. Microsoft took the unexpected step of issuing a critical security patch for Windows XP (and Windows Server 2003) more than five years after Microsoft ended mainstream support. In other words, the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. The Remote Desktop Protocol (RDP) itself is not vulnerable. This vulnerability is pre-authentication and requires no user interaction. You’ll have to manually download and install it from Microsoft’s website.Īs Microsoft’s Security Response Center explains, this patch fixes a “wormable” vulnerability in Remote Desktop Service in Windows XP, Windows Server 2003, Windows 7, and Windows Server 2008: However, Windows Update won’t automatically install it. Microsoft just patched a remote code execution hole in Windows XP with a critical update-over five years after it left mainstream support.
0 kommentar(er)
