CVE-2024-38074: Windows Server 2008 RCE Vulnerability

CVE-2024-38074 Overview

CVE-2024-38074 is a critical remote code execution vulnerability affecting the Windows Remote Desktop Licensing Service (RDL). This vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable Windows Server systems over the network without requiring any user interaction. The Remote Desktop Licensing Service is responsible for managing Remote Desktop Services (RDS) Client Access Licenses (CALs) and is commonly deployed in enterprise environments supporting remote desktop infrastructure.

Critical Impact

Unauthenticated remote code execution with complete system compromise potential across Windows Server infrastructure supporting Remote Desktop Services.

Affected Products

• Microsoft Windows Server 2008 R2 SP1 (x64)
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022 23H2

Discovery Timeline

• July 9, 2024 - CVE-2024-38074 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-38074

Vulnerability Analysis

This vulnerability resides in the Windows Remote Desktop Licensing Service, a critical component of Remote Desktop Services infrastructure. The flaw enables remote attackers to achieve code execution on affected servers without authentication, making it particularly dangerous for internet-exposed or internally accessible licensing servers. The vulnerability can be exploited remotely over the network with low attack complexity, requiring no privileges or user interaction, which significantly increases its exploitability in real-world scenarios.

The Remote Desktop Licensing Service typically listens on TCP port 135 (RPC) and dynamically assigned high ports for RPC communication. Organizations running RDS deployments with license servers are particularly at risk, as these servers are often centralized infrastructure components with broad network accessibility.

Root Cause

The vulnerability is attributed to CWE-191 (Integer Underflow), where an arithmetic operation produces a value that wraps around to an unexpectedly large value when subtracted below the minimum representable integer. This integer underflow condition can lead to memory corruption, enabling attackers to manipulate program execution flow and achieve arbitrary code execution on the target system.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can send specially crafted requests to the Remote Desktop Licensing Service that trigger the integer underflow condition. When successful exploitation occurs, the attacker gains the ability to execute arbitrary code with the privileges of the RDL service, which typically runs with SYSTEM-level permissions.

The exploitation does not require any form of authentication to the target system, and no user interaction is needed. This makes the vulnerability particularly suitable for automated exploitation and potential inclusion in worm-like propagation scenarios across enterprise networks where multiple licensing servers may be deployed.

Detection Methods for CVE-2024-38074

Indicators of Compromise

• Unexpected crashes or restarts of the Remote Desktop Licensing Service (TermServLicensing)
• Anomalous network traffic targeting RPC endpoints associated with the RDL service
• Suspicious process spawning from lserver.exe (Remote Desktop Licensing Service executable)
• Memory access violations or heap corruption events in Windows event logs related to the licensing service

Detection Strategies

• Monitor for unusual RPC traffic patterns to Remote Desktop Licensing Service endpoints
• Implement network intrusion detection rules for malformed RDL protocol requests
• Enable Windows Defender Exploit Guard to detect memory corruption exploitation attempts
• Deploy endpoint detection and response (EDR) solutions to identify suspicious behavior from lserver.exe

Monitoring Recommendations

• Configure Windows Event Log monitoring for Event ID 1000 (Application Error) associated with lserver.exe
• Implement network segmentation monitoring to detect unauthorized access attempts to licensing servers
• Enable process creation auditing to track child processes spawned by the Remote Desktop Licensing Service
• Monitor for lateral movement attempts originating from compromised licensing servers

How to Mitigate CVE-2024-38074

Immediate Actions Required

• Apply the July 2024 Microsoft security updates immediately to all affected Windows Server systems
• If patching is not immediately possible, disable the Remote Desktop Licensing Service on systems where it is not required
• Implement network segmentation to restrict access to RDL servers to only authorized administrative hosts
• Enable Windows Firewall rules to block inbound RPC traffic from untrusted networks to licensing servers

Patch Information

Microsoft has released security updates addressing CVE-2024-38074 as part of the July 2024 Patch Tuesday release. Administrators should apply the appropriate cumulative update for their Windows Server version through Windows Update, WSUS, or Microsoft Update Catalog. The Microsoft Security Update Guide provides detailed patch information and download links for all affected Windows Server versions.

Workarounds

• Disable the Remote Desktop Licensing Service (TermServLicensing) on servers where it is not actively required for RDS CAL management
• Implement strict network access controls using Windows Firewall to limit RPC access to trusted administrative workstations only
• Consider using VPN or jump server architecture to isolate Remote Desktop Licensing servers from direct network exposure
• Deploy application control policies to monitor and restrict execution of unauthorized code on licensing servers

# Disable Remote Desktop Licensing Service (if not required)
sc config TermServLicensing start= disabled
sc stop TermServLicensing

# Verify service status
sc query TermServLicensing

# Block RPC access from untrusted networks (example firewall rule)
netsh advfirewall firewall add rule name="Block RDL RPC" dir=in action=block protocol=tcp localport=135 remoteip=any