Feeds

Minor glitch in Win2K patch

Less serious than the disease

  • alert
  • submit to reddit

Using blade systems to cut costs and sharpen efficiencies

A patch for a serious flaw in Windows 2000, which prompted a major Microsoft alert earlier this week, is causing problems for a small percentage of users.

Applying the patch on top of earlier Win2K hot fixes can sometimes result in the dreaded Blue Screen of Death. The problem arises only for W2K SP2 machines which had unspecified Hotfixes applied which were received directly from Microsoft Product Support Services (PSS).

Russ Cooper, Surgeon-General of TruSecure Corporation and editor of the NTBugtraq mailing list, has published a support pagedocumenting the problem.

He estimates that fewer than one in 100 users applying the patch will experience the problem, but it can get a little messy for those who do. Users experiencing the Blue Screen will have to upgrade to Windows 2000 SP3 prior to applying the patch. This process may involve using Windows 2000 Recovery Console.

So in essence, the unlucky few must return their machines back to a vulnerable state and then proceed from there: applying SP3 then the patch. Windows Update won't help in this, according to Cooper.

He believes that problems with the patch arose because of insufficient testing by Microsoft. In fairness, Microsoft was forced by external events to rush matters.

That's because the flaw had become the subject of a zero-day exploit, prior to Microsoft contacting its customers (and, most unusually, us) about an imminent alert on Monday.

Last Wednesday (March 12) a "government official" contacted Cooper to inform him that the vulnerability had been used to compromise a military Web server. Cooper, who heard of no other assaults believes this, believes this was a targeted attack (i.e. it was directed by some unknown person and was not the result of viral activity). Details of the attack remain sketchy and its unclear how much harm was done.

News of the assault prompted Microsoft to act far more quickly than is usually the case. And although there have been limited glitches with the patch Microsoft developed, it's worth noting that the cure is much better than the disease.

This flaw, the root cause of which is a Buffer Overflow vulnerability in a core Microsoft Windows DLL (ntdll.dll), could allow attackers to gain complete control of a vulnerable system and execute arbitrary code.

The ISS WebDAV (World Wide Web Distributed Authoring and Versioning) is one of many Windows components
which uses ntdll.dll. So although most of the coverage of the problem thus far has concentrated on IIS as a vector for the attack, the patch needs to be applied to all potentially vulnerable Windows 2000 boxes.

Cooper is concerned that attacks based on the core vulnerability, but not directed at Microsoft's IIS Web Server specifically, may be coded into future viral attacks, which would reveal the full scope of the problem.

All the reason then for admins to shore up defences, prior to any possible assault.

Security clearing house CERT's advisory on the vulnerability provides a useful first port of call, while Microsoft's security notice can be found here. ®

Related Stories

Win2K Web Server software brown alert goes out

Windows Root kits a stealthy threat
UK e-commerce sites: Top 10 flaws
Open and closed security are roughly equivalent
The MS 'friendly' security alert service - just say D'oh

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.