Microsoft Windows Bluetooth CVE-2019-9506 Remote Security Vulnerability

Description

Microsoft Windows Bluetooth is prone to a remote security vulnerability. An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks.

Technologies Affected

• Cisco 8821 Wireless IP Phones
• Cisco 8845 IP Phones
• Cisco 8851 IP Phones
• Cisco 8861 IP Phones
• Cisco 8865 IP Phones
• Cisco SPA525G2 Small Business IP Phones
• Cisco Webex DX70
• Cisco Webex DX80
• Microsoft Windows 10 Version 1607 for 32-bit Systems
• Microsoft Windows 10 Version 1607 for x64-based Systems
• Microsoft Windows 10 Version 1709 for ARM64-based Systems
• Microsoft Windows 10 Version 1803 for 32-bit Systems
• Microsoft Windows 10 Version 1803 for ARM64-based Systems
• Microsoft Windows 10 Version 1803 for x64-based Systems
• Microsoft Windows 10 Version 1809 for 32-bit Systems
• Microsoft Windows 10 Version 1809 for ARM64-based Systems
• Microsoft Windows 10 Version 1809 for x64-based Systems
• Microsoft Windows 10 Version 1903 for 32-bit Systems
• Microsoft Windows 10 Version 1903 for ARM64-based Systems
• Microsoft Windows 10 Version 1903 for x64-based Systems
• Microsoft Windows 10 for 32-bit Systems
• Microsoft Windows 10 for x64-based Systems
• Microsoft Windows 10 version 1703 for 32-bit Systems
• Microsoft Windows 10 version 1703 for x64-based Systems
• Microsoft Windows 10 version 1709 for 32-bit Systems
• Microsoft Windows 10 version 1709 for x64-based Systems
• Microsoft Windows 7 for 32-bit Systems SP1
• Microsoft Windows 7 for x64-based Systems SP1
• Microsoft Windows 8.1 for 32-bit Systems
• Microsoft Windows 8.1 for x64-based Systems
• Microsoft Windows RT 8.1
• Microsoft Windows Server 1803
• Microsoft Windows Server 1903
• Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
• Microsoft Windows Server 2008 R2 for x64-based Systems SP1
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019

Recommendations

Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from a successful exploit.

Do not accept or execute files from untrusted or unknown sources.
To limit exposure to these and other latent vulnerabilities, never handle files that originate from unfamiliar or untrusted sources.

Do not follow links provided by unknown or untrusted sources.
To reduce the likelihood of attacks, never visit sites of questionable integrity or follow links provided by unfamiliar or untrusted sources.

Implement multiple redundant layers of security.
As an added precaution, deploy memory-protection schemes (such as nonexecutable stack/heap configuration and randomly mapped memory segments). This may complicate exploits of memory-corruption vulnerabilities.

Run all software as a nonprivileged user with minimal access rights.
To reduce the impact of latent vulnerabilities, run applications with the minimal amount of privileges required for functionality.

Updates are available. Please see the references or vendor advisory for more information.