Vulcan Cyber is on a mission to help businesses own and mitigate risk. That’s why we do our own research on the most searched CVEs to make sure our community is up to date with the industry’s latest concerns. SEO tool Ahrefs has shown us that in the last few weeks, CVE-2017-14491 and CVE-2019-0708, two high-to-critical vulnerabilities from 2017 and 2019 respectively, are amongst the top most-searched CVEs.
Let’s explore them together:
What are the CVE-2017-14491 and CVE-2019-0708 vulnerabilities?
CVE-2017-14491, The DNSMasq: Heap buffer overflow vulnerability allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
CVE-2019-0708, the BlueKeep RDP vulnerability is a remote code execution vulnerability that exists in Remote Desktop Services (formerly known as Terminal Services). It involves an unauthenticated attacker connecting to the target system using RDP and sending specially crafted requests.
Do they affect me?
CVE-2017-14491 (High severity): If you’re using dnsmasq before version 2.78, you’re most likely affected. We suggest remediating this vulnerability immediately.
CVE-2019-0708 (Critical): If you’re running any of the below versions of Microsoft Windows, then you’re probably affected:
- Windows XP
- Windows Vista
- Windows 7
- Windows Server 2003
- Windows Server 2008
- Windows Server 2008 R2
How to remediate CVE-2017-14491 and CVE-2019-0708?
CVE-2017-14491: Update update update. Newer versions of dnmasq are available which effectively address this vulnerability. The latest version was published back in 2017, and then updated in 2018. You can find all available fixes in the Vulcan Cyber Remedy Cloud.
CVE-2019-0708: You’ll be surprised to learn that the solution here is also: update update update! Microsoft released regular updates from May 2019 to fix this vulnerability. The latest came in August 2019. Note: this vulnerability is critical and requires your immediate attention. If you haven’t fixed it yet, now is the time. Remedy Cloud has got your back with all the fixes.
These vulnerabilities have been around for years but like many others, have gone unremediated. Thankfully, the fixes have been around for just as long. We haven’t seen any recent news about exploits of these vulnerabilities, but wanted to draw your attention to them so you can stay ahead.
Vulcan Cyber is committed to helping the cyber security community improve their security posture and cyber hygiene, through better, efficient and structured vulnerability management programs. Own your risk by following us on LinkedIn and checking out our latest cyber risk mitigation updates.
