Feeds

MS amends anti-Blaster fix

Vulnerability deep, risk high

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

Microsoft today issued an amended antidote to the Windows vulnerability infamously exploited by the Blaster worm.

Today's fix for flaws with Microsoft's implementation of Remote Procedure Calls (RPC) within its Distributed Component Object Model (DCOM) framework supersede a patch Redmond issued in July. It also replaces a fix (MS01-48) involving a DoS risk MS issued two years ago.

The July patch is effective at stopping the flaw Blaster exploits. The trouble is there are more than one flaw with Microsoft's implementation of an RPC interface for Distributed Component Object Model services (DCOM). This gives rise to security vulnerabilities not fixed by the first patch.

According to Microsoft's revised bulletin, it turns out there are "three identified vulnerabilities" in the RPCSS Service that deal with DCOM activation - two that could allow arbitrary code execution and one that could result in a denial of service.

"An attacker who successfully exploited these vulnerabilities could be able to run code with local system privileges on an affected system, or could cause the RPCSS Service to fail. The attacker could then be able to take any action on the system, including installing programs, viewing, changing or deleting data, or creating new accounts with full privileges," Microsoft warns.

The issue affects the underlying RPCSS Service used for DCOM activation, which listens on UDP ports 135, 137, 138, 445 and TCP ports 135, 139, 445, 593. Additionally, it can listen on ports 80 and 443 if COM Internet Services (CIS) or RPC over HTTP is enabled.

This complicates procedures for mitigating against the threat - we now have to worry about a far wider range of ports beyond port 135 used by Blaster to spread. Workarounds involving turning off services and blocking ports on the firewall could be attempted but the risk of affecting legitimate services is that much greater.

No surprise then that Microsoft describes its latest fix as 'critical'. As before the flaws Microsoft has identified affect Windows NT 4, NT 4 Terminal Edition, Win 2000, XP and Win 2003. Once again only Windows 98 and Me users are left off the hook.

Microsoft recommends that system administrators "should apply the security patch immediately", unusually forceful advice from the software giant. But given the possibility of Blaster-type worms arising from the flaws MS has identified it's a recommendation well worth heeding.

The advisory, which provides links to patches and details workarounds, can be found here. ®

Related Stories

Blaster worm spreading rapidly
Blaster rewrites Windows worm rules
Windows Update still standing despite Blaster
Blaster variant offers 'fix' for pox-ridden PCs
FBI arrests Blaster suspect
Feds sexed up case - Blaster suspect
Panel probes the half-life of bugs

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.