Feeds

Minor glitch in Win2K patch

Less serious than the disease

  • alert
  • submit to reddit

Boost IT visibility and business value

A patch for a serious flaw in Windows 2000, which prompted a major Microsoft alert earlier this week, is causing problems for a small percentage of users.

Applying the patch on top of earlier Win2K hot fixes can sometimes result in the dreaded Blue Screen of Death. The problem arises only for W2K SP2 machines which had unspecified Hotfixes applied which were received directly from Microsoft Product Support Services (PSS).

Russ Cooper, Surgeon-General of TruSecure Corporation and editor of the NTBugtraq mailing list, has published a support pagedocumenting the problem.

He estimates that fewer than one in 100 users applying the patch will experience the problem, but it can get a little messy for those who do. Users experiencing the Blue Screen will have to upgrade to Windows 2000 SP3 prior to applying the patch. This process may involve using Windows 2000 Recovery Console.

So in essence, the unlucky few must return their machines back to a vulnerable state and then proceed from there: applying SP3 then the patch. Windows Update won't help in this, according to Cooper.

He believes that problems with the patch arose because of insufficient testing by Microsoft. In fairness, Microsoft was forced by external events to rush matters.

That's because the flaw had become the subject of a zero-day exploit, prior to Microsoft contacting its customers (and, most unusually, us) about an imminent alert on Monday.

Last Wednesday (March 12) a "government official" contacted Cooper to inform him that the vulnerability had been used to compromise a military Web server. Cooper, who heard of no other assaults believes this, believes this was a targeted attack (i.e. it was directed by some unknown person and was not the result of viral activity). Details of the attack remain sketchy and its unclear how much harm was done.

News of the assault prompted Microsoft to act far more quickly than is usually the case. And although there have been limited glitches with the patch Microsoft developed, it's worth noting that the cure is much better than the disease.

This flaw, the root cause of which is a Buffer Overflow vulnerability in a core Microsoft Windows DLL (ntdll.dll), could allow attackers to gain complete control of a vulnerable system and execute arbitrary code.

The ISS WebDAV (World Wide Web Distributed Authoring and Versioning) is one of many Windows components
which uses ntdll.dll. So although most of the coverage of the problem thus far has concentrated on IIS as a vector for the attack, the patch needs to be applied to all potentially vulnerable Windows 2000 boxes.

Cooper is concerned that attacks based on the core vulnerability, but not directed at Microsoft's IIS Web Server specifically, may be coded into future viral attacks, which would reveal the full scope of the problem.

All the reason then for admins to shore up defences, prior to any possible assault.

Security clearing house CERT's advisory on the vulnerability provides a useful first port of call, while Microsoft's security notice can be found here. ®

Related Stories

Win2K Web Server software brown alert goes out

Windows Root kits a stealthy threat
UK e-commerce sites: Top 10 flaws
Open and closed security are roughly equivalent
The MS 'friendly' security alert service - just say D'oh

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?