{"id":95306,"date":"2019-05-21T14:09:35","date_gmt":"2019-05-21T21:09:35","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=95306"},"modified":"2025-06-04T02:18:41","modified_gmt":"2025-06-04T09:18:41","slug":"rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/","title":{"rendered":"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability"},"content":{"rendered":"<p>During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP). What was unique in this particular patch cycle was that Microsoft produced a fix for Windows XP and several other operating systems, which have not been supported for security updates in years. So why the urgency and what made Microsoft decide that this was a high risk and critical patch?<\/p>\n<p>According to the <a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0708\" target=\"_blank\" rel=\"noopener noreferrer\">advisory<\/a>, the issue discovered was serious enough that it led to Remote Code Execution and was wormable, meaning it could spread automatically on unprotected systems. The bulletin referenced well-known network worm \u201cWannaCry\u201d which was heavily exploited just a couple of months after Microsoft released MS17-010 as a patch for the related vulnerability in March 2017. McAfee Advanced Threat Research has been analyzing this latest bug to help prevent a similar scenario and we are urging those with unpatched and affected systems to apply the patch for CVE-2019-0708 as soon as possible. It is extremely likely malicious actors have weaponized this bug and exploitation attempts will likely be observed in the wild in the very near future.<\/p>\n<h2><u>Vulnerable Operating Systems:<\/u><\/h2>\n<ul>\n<li>Windows 2003<\/li>\n<li>Windows XP<\/li>\n<li>Windows 7<\/li>\n<li>Windows Server 2008<\/li>\n<li>Windows Server 2008 R2<\/li>\n<\/ul>\n<p>Worms are viruses which primarily replicate on networks. A worm will typically execute itself automatically on a remote machine without any extra help from a user. If a virus\u2019 primary attack vector is via the network, then it should be classified as a worm.<\/p>\n<p>The Remote Desktop Protocol (RDP) enables connection between a client and endpoint, defining the data communicated between them in virtual channels. Virtual channels are bidirectional data pipes which enable the extension of RDP. Windows Server 2000 defined 32 Static Virtual Channels (SVCs) with RDP 5.1, but due to limitations on the number of channels further defined Dynamic Virtual Channels (DVCs), which are contained within a dedicated SVC. SVCs are created at the start of a session and remain until session termination, unlike DVCs which are created and torn down on demand.<\/p>\n<p>It\u2019s this 32 SVC binding which CVE-2019-0708 patch fixes within the <em>_IcaBindVirtualChannels<\/em> and <em>_IcaRebindVirtualChannels<\/em> functions in the RDP driver termdd.sys. As can been seen in figure 1, the RDP Connection Sequence connections are initiated and channels setup prior to Security Commencement, which enables CVE-2019-0708 to be wormable since it can self-propagate over the network once it discovers open port 3389.<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-95317 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-2.02.33-PM.png\" alt=\"\" width=\"582\" height=\"650\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-2.02.33-PM.png 582w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-2.02.33-PM-269x300.png 269w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-2.02.33-PM-448x500.png 448w\" sizes=\"auto, (max-width: 582px) 100vw, 582px\" \/><\/p>\n<p><em>Figure 1: RDP <\/em><a href=\"https:\/\/docs.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-rdpbcgr\/023f1e69-cfe8-4ee6-9ee0-7e759fb4e4ee\" target=\"_blank\" rel=\"noopener noreferrer\"><em>Protocol Sequence<\/em><\/a><\/p>\n<p>The vulnerability is due to the \u201cMS_T120\u201d SVC name being bound as a reference channel to the number 31 during the GCC Conference Initialization sequence of the RDP protocol. This channel name is used internally by Microsoft and there are no apparent legitimate use cases for a client to request connection over an SVC named \u201cMS_T120.\u201d<\/p>\n<p>Figure 2 shows legitimate channel requests during the GCC Conference Initialization sequence with no MS_T120 channel.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-95308 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/05\/Picture2.png\" alt=\"\" width=\"939\" height=\"585\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture2.png 939w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture2-300x187.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture2-768x478.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture2-803x500.png 803w\" sizes=\"auto, (max-width: 939px) 100vw, 939px\" \/><\/p>\n<p><em>Figure 2: Standard GCC Conference Initialization Sequence<\/em><\/p>\n<p>However, during GCC Conference Initialization, the Client supplies the channel name which is not whitelisted by the server, meaning an attacker can setup another SVC named \u201cMS_T120\u201d on a channel other than 31. It\u2019s the use of MS_T120 in a channel other than 31 that leads to heap memory corruption and remote code execution (RCE).<\/p>\n<p>Figure 3 shows an abnormal channel request during the GCC Conference Initialization sequence with \u201cMS_T120\u201d channel on channel number 4.<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-95322 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.08-PM.png\" alt=\"\" width=\"1188\" height=\"928\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.08-PM.png 1188w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.08-PM-300x234.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.08-PM-768x600.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.08-PM-1024x800.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.08-PM-640x500.png 640w\" sizes=\"auto, (max-width: 1188px) 100vw, 1188px\" \/><\/p>\n<p><em>Figure 3: Abnormal\/Suspicious GCC Conference Initialization Sequence \u2013 MS_T120 on nonstandard channel<\/em><\/p>\n<p>The components involved in the MS_T120 channel management are highlighted in figure 4. The MS_T120 reference channel is created in the rdpwsx.dll and the heap pool allocated in rdpwp.sys. The heap corruption happens in termdd.sys when the MS_T120 reference channel is processed within the context of a channel index other than 31.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-95310 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/05\/Picture4.png\" alt=\"\" width=\"939\" height=\"545\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture4.png 939w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture4-300x174.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture4-768x446.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture4-861x500.png 861w\" sizes=\"auto, (max-width: 939px) 100vw, 939px\" \/><\/p>\n<p><em>Figure 4: Windows Kernel and User Components <\/em><\/p>\n<p>The Microsoft patch as shown in figure 5 now adds a check for a client connection request using channel name \u201cMS_T120\u201d and ensures it binds to channel 31 <strong>only<\/strong> (1Fh) in the <em>_IcaBindVirtualChannels<\/em> and <em>_IcaRebindVirtualChannels<\/em> functions within termdd.sys.<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-95323 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.19-PM.png\" alt=\"\" width=\"1192\" height=\"748\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.19-PM.png 1192w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.19-PM-300x188.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.19-PM-768x482.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.19-PM-1024x643.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Screen-Shot-2019-05-21-at-5.22.19-PM-797x500.png 797w\" sizes=\"auto, (max-width: 1192px) 100vw, 1192px\" \/><\/p>\n<p><em>Figure 5: Microsoft Patch Adding Channel Binding Check<\/em><\/p>\n<p>After we investigated the patch being applied for both Windows 2003 and XP and understood how the RDP protocol was parsed before and after patch, we decided to test and create a Proof-of-Concept (PoC) that would use the vulnerability and remotely execute code on a victim\u2019s machine to launch the calculator application, a well-known litmus test for remote code execution.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-95312 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/05\/Picture6.png\" alt=\"\" width=\"1004\" height=\"218\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture6.png 1004w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture6-300x65.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture6-768x167.png 768w\" sizes=\"auto, (max-width: 1004px) 100vw, 1004px\" \/><\/p>\n<p><em>Figure 6: Screenshot of our PoC executing<\/em><\/p>\n<p>For our setup, RDP was running on the machine and we confirmed we had the unpatched versions running on the test setup. The result of our exploit can be viewed in the following video:<\/p>\n<p><iframe loading=\"lazy\" src=\"https:\/\/www.youtube.com\/embed\/syF6rSM0JSM\" width=\"560\" height=\"315\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>There is a gray area to responsible disclosure. With our investigation we can confirm that the exploit is working and that it is possible to remotely execute code on a vulnerable system without authentication. Network Level Authentication should be effective to stop this exploit if enabled; however, if an attacker has credentials, they will bypass this step.<\/p>\n<p>As a patch is available, we decided not to provide earlier in-depth detail about the exploit or publicly release a proof of concept. That would, in our opinion, not be responsible and may further the interests of malicious adversaries.<\/p>\n<h2><u>Recommendations:<\/u><\/h2>\n<ul>\n<li>We can confirm that a patched system will stop the exploit and highly recommend patching as soon as possible.<\/li>\n<li>Disable RDP from outside of your network and limit it internally; disable entirely if not needed. The exploit is not successful when RDP is disabled.<\/li>\n<li>Client requests with \u201cMS_T120\u201d on any channel other than 31 during GCC Conference Initialization sequence of the RDP protocol should be blocked unless there is evidence for legitimate use case.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>It is important to note as well that the RDP default port can be changed in a registry field, and after a reboot will be tied the newly specified port. From a detection standpoint this is highly relevant.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-95313 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/05\/Picture7.png\" alt=\"\" width=\"847\" height=\"389\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture7.png 847w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture7-300x138.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/05\/Picture7-768x353.png 768w\" sizes=\"auto, (max-width: 847px) 100vw, 847px\" \/><\/p>\n<p><em>Figure 7: RDP default port can be modified in the registry<\/em><\/p>\n<p>Malware or administrators inside of a corporation can change this with admin rights (or with a program that bypasses UAC) and write this new port in the registry; if the system is not patched the vulnerability will still be exploitable over the unique port.<\/p>\n<p><u>McAfee Customers:<\/u><\/p>\n<p>McAfee NSP customers are protected via the following signature released on 5\/21\/2019:<\/p>\n<p>0x47900c00 \u201cRDP: Microsoft Remote Desktop MS_T120 Channel Bind Attempt\u201d<\/p>\n<p>If you have any questions, please contact <a href=\"https:\/\/support.mcafee.com\" target=\"_blank\" rel=\"noopener noreferrer\">McAfee Technical Support<\/a>.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP)&#8230;.<\/p>\n","protected":false},"author":1061,"featured_media":94495,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[5657,5540,5656,3576,5354],"class_list":["post-95306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability | McAfee Blog<\/title>\n<meta name=\"description\" content=\"During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP). What was unique in\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP). What was unique in\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2019-05-21T21:09:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-04T09:18:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1555\" \/>\n\t<meta property=\"og:image:height\" content=\"1037\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Eoin Carroll, Alexandre Mundo, Philippe Laulheret, Christiaan Beek, Steve Povolny\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@w3knight\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Eoin Carroll, Alexandre Mundo, Philippe Laulheret, Christiaan Beek, Steve Povolny\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/\"},\"author\":{\"name\":\"Eoin Carroll\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6e361f03260be663c75dcf535cf8594d\"},\"headline\":\"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability\",\"datePublished\":\"2019-05-21T21:09:35+00:00\",\"dateModified\":\"2025-06-04T09:18:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/\"},\"wordCount\":1086,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg\",\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/\",\"name\":\"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg\",\"datePublished\":\"2019-05-21T21:09:35+00:00\",\"dateModified\":\"2025-06-04T09:18:41+00:00\",\"description\":\"During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP). What was unique in\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg\",\"width\":1555,\"height\":1037},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability CVE-2019-0708\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6e361f03260be663c75dcf535cf8594d\",\"name\":\"Eoin Carroll\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/b189b41d5342c1f01c13b31cd502abee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Eoin-Carroll-Pic-1-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Eoin-Carroll-Pic-1-96x96.jpg\",\"caption\":\"Eoin Carroll\"},\"description\":\"Eoin Carroll is a Principal Engineer and Senior Vulnerability Researcher on the McAfee Advanced Threat Research team, focused on researching the trustworthiness of emerging computing platforms and protocols. He also analyzes critical industry vulnerabilities and innovates advanced threat defenses. He has 20 years of diverse experience, from electronic engineering to a variety of offensive and defensive security roles. For the first decade of his career he worked as an electronic engineer in both the semiconductor and medical device industries, gaining a wealth of engineering and risk experience. During the second decade he has been building his career in platform security through Product Security, reverse engineering critical industry vulnerabilities and designing exploit protections. In addition, he has lead Product Security teams, mentored many Product Security Engineers\/Architects, supported local universities to keep their security curriculum relevant to industry needs and regularly speaks at universities and STEM events to inspire the next generation of security talent. He is very passionate about analyzing the security models of emerging platforms and protocols against the current and future threat landscape. His work experience includes threat modeling, secure platform design, memory forensics, vulnerability and exploit analysis, reverse engineering, product engineering, operating system internals and incident response.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/eoin-carroll-641ba08\/\",\"https:\/\/x.com\/w3knight\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/eoin-carroll\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability | McAfee Blog","description":"During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP). What was unique in","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability | McAfee Blog","og_description":"During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP). What was unique in","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2019-05-21T21:09:35+00:00","article_modified_time":"2025-06-04T09:18:41+00:00","og_image":[{"width":1555,"height":1037,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg","type":"image\/jpeg"}],"author":"Eoin Carroll, Alexandre Mundo, Philippe Laulheret, Christiaan Beek, Steve Povolny","twitter_card":"summary_large_image","twitter_creator":"@w3knight","twitter_site":"@McAfee","twitter_misc":{"Written by":"Eoin Carroll, Alexandre Mundo, Philippe Laulheret, Christiaan Beek, Steve Povolny","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/"},"author":{"name":"Eoin Carroll","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6e361f03260be663c75dcf535cf8594d"},"headline":"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability","datePublished":"2019-05-21T21:09:35+00:00","dateModified":"2025-06-04T09:18:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/"},"wordCount":1086,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg","articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/","name":"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg","datePublished":"2019-05-21T21:09:35+00:00","dateModified":"2025-06-04T09:18:41+00:00","description":"During Microsoft\u2019s May Patch Tuesday cycle, a security advisory was released for a vulnerability in the Remote Desktop Protocol (RDP). What was unique in","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Programming-code-abstract-screen-of-software-developer.-Computer-script.-copy.jpg","width":1555,"height":1037},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"RDP Stands for \u201cReally DO Patch!\u201d \u2013 Understanding the Wormable RDP Vulnerability CVE-2019-0708"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6e361f03260be663c75dcf535cf8594d","name":"Eoin Carroll","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/b189b41d5342c1f01c13b31cd502abee","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Eoin-Carroll-Pic-1-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2019\/03\/Eoin-Carroll-Pic-1-96x96.jpg","caption":"Eoin Carroll"},"description":"Eoin Carroll is a Principal Engineer and Senior Vulnerability Researcher on the McAfee Advanced Threat Research team, focused on researching the trustworthiness of emerging computing platforms and protocols. He also analyzes critical industry vulnerabilities and innovates advanced threat defenses. He has 20 years of diverse experience, from electronic engineering to a variety of offensive and defensive security roles. For the first decade of his career he worked as an electronic engineer in both the semiconductor and medical device industries, gaining a wealth of engineering and risk experience. During the second decade he has been building his career in platform security through Product Security, reverse engineering critical industry vulnerabilities and designing exploit protections. In addition, he has lead Product Security teams, mentored many Product Security Engineers\/Architects, supported local universities to keep their security curriculum relevant to industry needs and regularly speaks at universities and STEM events to inspire the next generation of security talent. He is very passionate about analyzing the security models of emerging platforms and protocols against the current and future threat landscape. His work experience includes threat modeling, secure platform design, memory forensics, vulnerability and exploit analysis, reverse engineering, product engineering, operating system internals and incident response.","sameAs":["https:\/\/www.linkedin.com\/in\/eoin-carroll-641ba08\/","https:\/\/x.com\/w3knight"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/eoin-carroll\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/95306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/1061"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=95306"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/95306\/revisions"}],"predecessor-version":[{"id":215082,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/95306\/revisions\/215082"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/94495"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=95306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=95306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=95306"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=95306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}