How to find Windows Remote Desktop Licensing Services on your network

|
Updated

Latest vulnerability: CVE-2024-38077 #

Microsoft has disclosed multiple vulnerabilities in their Windows Remote Desktop Licensing Service product.

CVE-2024-38077 is rated critical with CVSS score of 9.8 and allows an attacker to remotely execute code which could lead to complete system compromise.

What is the impact? #

A heap overflow flaw could allow an attacker to send a message that would trigger this vulnerability and allow remote code execution. With the right code execution this could lead to a complete system compromise giving the attacker complete control.

Are updates or workarounds available? #

Microsoft has released patches to address this vulnerability. Instances should be updated immediately to the latest patched version. Additionally, if this service is not needed, it is advisable to disable it or, at the very least, ensure it is securely firewalled within business networks.

How to find potentially vulnerable systems with runZero #

From the Service Inventory, use the following query to locate systems running potentially vulnerable software:

port:135 AND protocol:epm AND _service.epm.uuids:"3d267954-eeb7-11d1-b94e-00c04fa3080d"

You may also search for associated named pipes:

port:135 AND protocol:epm AND _service.epm.pipes:"HydraLsPipe"

Written by Blain Smith

Blain Smith is a Security Research Engineer at runZero. He spent most of his career in cloud and distributed systems for AAA gaming, entertainment, and networking working on some of the most popular games and systems millions of people play and watch daily. He has given numerous talks at conferences such as TEDx, GopherCon, and P99CONF. His shift into infosec has afforded him the ability to apply his distributed systems and networking knowledge to other industries such as IoT and OT.

More about Blain Smith
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.


Related Articles

Rapid Response
How to find Cisco NX-OS assets on your network
Cisco has released an advisory for a vulnerability found within their NX-OS software. Here's how to find affected assets.
Rapid Response
How to find Citrix Virtual Apps and Desktops software on your network
Citrix has released an advisory for two vulnerabilities affecting Citrix Virtual Apps and Desktops software.
Rapid Response
How to find FortiManager instances on your network
How to find FortiManager instances on your network using runZero
Rapid Response
How to find SolarWinds Web Help Desk services on your network
CISA has announced that CVE-2024-28987 is actively being exploited in SolarWinds' Web Help Desk software. Here's how to find potentially affected...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved