Minor glitch in Win2K patch

Less serious than the disease

A patch for a serious flaw in Windows 2000, which prompted a major Microsoft alert earlier this week, is causing problems for a small percentage of users.

Applying the patch on top of earlier Win2K hot fixes can sometimes result in the dreaded Blue Screen of Death. The problem arises only for W2K SP2 machines which had unspecified Hotfixes applied which were received directly from Microsoft Product Support Services (PSS).

Russ Cooper, Surgeon-General of TruSecure Corporation and editor of the NTBugtraq mailing list, has published a support pagedocumenting the problem.

He estimates that fewer than one in 100 users applying the patch will experience the problem, but it can get a little messy for those who do. Users experiencing the Blue Screen will have to upgrade to Windows 2000 SP3 prior to applying the patch. This process may involve using Windows 2000 Recovery Console.

So in essence, the unlucky few must return their machines back to a vulnerable state and then proceed from there: applying SP3 then the patch. Windows Update won't help in this, according to Cooper.

He believes that problems with the patch arose because of insufficient testing by Microsoft. In fairness, Microsoft was forced by external events to rush matters.

That's because the flaw had become the subject of a zero-day exploit, prior to Microsoft contacting its customers (and, most unusually, us) about an imminent alert on Monday.

Last Wednesday (March 12) a "government official" contacted Cooper to inform him that the vulnerability had been used to compromise a military Web server. Cooper, who heard of no other assaults believes this, believes this was a targeted attack (i.e. it was directed by some unknown person and was not the result of viral activity). Details of the attack remain sketchy and its unclear how much harm was done.

News of the assault prompted Microsoft to act far more quickly than is usually the case. And although there have been limited glitches with the patch Microsoft developed, it's worth noting that the cure is much better than the disease.

This flaw, the root cause of which is a Buffer Overflow vulnerability in a core Microsoft Windows DLL (ntdll.dll), could allow attackers to gain complete control of a vulnerable system and execute arbitrary code.

The ISS WebDAV (World Wide Web Distributed Authoring and Versioning) is one of many Windows components
which uses ntdll.dll. So although most of the coverage of the problem thus far has concentrated on IIS as a vector for the attack, the patch needs to be applied to all potentially vulnerable Windows 2000 boxes.

Cooper is concerned that attacks based on the core vulnerability, but not directed at Microsoft's IIS Web Server specifically, may be coded into future viral attacks, which would reveal the full scope of the problem.

All the reason then for admins to shore up defences, prior to any possible assault.

Security clearing house CERT's advisory on the vulnerability provides a useful first port of call, while Microsoft's security notice can be found here. ®

Related Stories

Win2K Web Server software brown alert goes out

Windows Root kits a stealthy threat
UK e-commerce sites: Top 10 flaws
Open and closed security are roughly equivalent
The MS 'friendly' security alert service - just say D'oh

Sponsored: How to determine if cloud backup is right for your servers