Apply patches immediately!

A critical vulnerability disclosed by CERT-FR on April 13 affects the majority of Windows users (desktops and servers). By exploiting this vulnerability, an attacker could remotely execute arbitrary code, thereby potentially taking control of your machines.

What Are the Risks to Your Business?

This vulnerability could seriously compromise the confidentiality of your data.

Rated 9.8/10 by Microsoft (CVSS 3.1 score), this vulnerability is particularly critical because it affects many users and is relatively easy for attackers to exploit remotely over the network. No special privileges or user interaction are required.

To exploit this vulnerability, an attacker must send a specially crafted RPC call to an RPC host. This could result in remote code execution on the server side, with the same permissions as the RPC service.

AFFECTED SYSTEMS

  • Windows 7 to Windows 11
  • Windows Server 2008 through Windows Server 2022, including installations in "Core" mode

How to protect yourself against it?

Hundreds of vulnerabilities are disclosed each week by software vendors, including Microsoft. It is essential to follow best practices for securing Microsoft environments.

> Block all SMB traffic on TCP ports 139 and 445, both inbound and outbound, to and from the information system.

> For internal network segmentation: Allow SMB traffic only when necessary (domain controllers, file servers, etc.) and block this traffic between workstations.

> For mobile workstations: Block all incoming and outgoing SMB traffic and allow such traffic to SMB servers only through a secure VPN. (Microsoft Guide to Securing SMB Traffic)

Additional recommendations:

> Don’t leave these types of services exposed and unprotected. ITrust offers tools to detect cyber threats, ransomware, viruses, and abnormal behavior within your IT infrastructure, such as our Reveelium UEBA SIEM.

> Regularly scan your network to identify security vulnerabilities and missing patches. Our Ikare vulnerability scanner, available as a free trial, detects newly identified security flaws.

If you require assistance remediating these vulnerabilities, contact us at +33 (0)5.67.34.67.80.

*Sources: CERT-FR , IT-Connect.fr, Microsoft