Feeds

Minor glitch in Win2K patch

Less serious than the disease

  • alert
  • submit to reddit

Security for virtualized datacentres

A patch for a serious flaw in Windows 2000, which prompted a major Microsoft alert earlier this week, is causing problems for a small percentage of users.

Applying the patch on top of earlier Win2K hot fixes can sometimes result in the dreaded Blue Screen of Death. The problem arises only for W2K SP2 machines which had unspecified Hotfixes applied which were received directly from Microsoft Product Support Services (PSS).

Russ Cooper, Surgeon-General of TruSecure Corporation and editor of the NTBugtraq mailing list, has published a support pagedocumenting the problem.

He estimates that fewer than one in 100 users applying the patch will experience the problem, but it can get a little messy for those who do. Users experiencing the Blue Screen will have to upgrade to Windows 2000 SP3 prior to applying the patch. This process may involve using Windows 2000 Recovery Console.

So in essence, the unlucky few must return their machines back to a vulnerable state and then proceed from there: applying SP3 then the patch. Windows Update won't help in this, according to Cooper.

He believes that problems with the patch arose because of insufficient testing by Microsoft. In fairness, Microsoft was forced by external events to rush matters.

That's because the flaw had become the subject of a zero-day exploit, prior to Microsoft contacting its customers (and, most unusually, us) about an imminent alert on Monday.

Last Wednesday (March 12) a "government official" contacted Cooper to inform him that the vulnerability had been used to compromise a military Web server. Cooper, who heard of no other assaults believes this, believes this was a targeted attack (i.e. it was directed by some unknown person and was not the result of viral activity). Details of the attack remain sketchy and its unclear how much harm was done.

News of the assault prompted Microsoft to act far more quickly than is usually the case. And although there have been limited glitches with the patch Microsoft developed, it's worth noting that the cure is much better than the disease.

This flaw, the root cause of which is a Buffer Overflow vulnerability in a core Microsoft Windows DLL (ntdll.dll), could allow attackers to gain complete control of a vulnerable system and execute arbitrary code.

The ISS WebDAV (World Wide Web Distributed Authoring and Versioning) is one of many Windows components
which uses ntdll.dll. So although most of the coverage of the problem thus far has concentrated on IIS as a vector for the attack, the patch needs to be applied to all potentially vulnerable Windows 2000 boxes.

Cooper is concerned that attacks based on the core vulnerability, but not directed at Microsoft's IIS Web Server specifically, may be coded into future viral attacks, which would reveal the full scope of the problem.

All the reason then for admins to shore up defences, prior to any possible assault.

Security clearing house CERT's advisory on the vulnerability provides a useful first port of call, while Microsoft's security notice can be found here. ®

Related Stories

Win2K Web Server software brown alert goes out

Windows Root kits a stealthy threat
UK e-commerce sites: Top 10 flaws
Open and closed security are roughly equivalent
The MS 'friendly' security alert service - just say D'oh

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.