Feeds

Microsoft on the hunt for 'serious' Windows flaw

Mass hijackings at risk

Boost IT visibility and business value

Microsoft bug squashers are investigating reports of a serious security vulnerability in Windows operating systems that could allow attackers to take control of vast numbers of machines, particularly those located off US shores.

A Microsoft spokesman had only minimal details about the investigation, which was prompted by a presentation last week by researcher Beau Butler at the Kiwicon security conference in New Zealand. According to this report in the Sydney Morning Herald, the flaw affects every version of Windows including Vista and is actually the continuation of an old vulnerability that Microsoft supposedly fixed years ago.

The bug, according to Symantec's DeepSight threat notification service, resides in a feature known as Web Proxy Autodiscovery (WPAD), which helps IT administrators automate the configuration of proxy settings in Internet Explorer and other web browsers. The vulnerability can be "widely exploited" to "intercept web sessions, direct browsers to malicious proxies, and effectively gain control over unsuspecting users' web traffic," according to Symantec, which said it had yet to confirm the vulnerability.

Vulnerable browsers will traverse a company's host domain to search for a WPAD data file used to set up the proxy feature. IE running on host a.b.c.d.net, for example, first would look in b.c.d.net, then c.d.net and finally d.net. "In certain configurations, the third-level domain is not a trusted part of the network; an attacker can set up a malicious driftnet-type WPAD server situated outside of an organization's normal administrative control," Symantec warned.

"Now that we understand the issue we're researching comprehensive mitigations and workarounds to protect customers," Microsoft's general manager of product security, George Stathakopoulos, wrote in an email to the Sydney Morning Herald. Engineers in Australia and the US were scrambling to replicate and confirm the issue over the US Thanksgiving holiday, according to the paper. A Microsoft spokesman had no additional details on Monday.

Microsoft appears to have released a patch for the vulnerability in 1999. But the patch only protected domain names ending in .com, so WPAD servers using all other addresses have remained vulnerable. ®

The essential guide to IT transformation

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Oracle reveals 32-core, 10 BEEELLION-transistor SPARC M7
New chip scales to 1024 cores, 8192 threads 64 TB RAM, at speeds over 3.6GHz
Docker kicks KVM's butt in IBM tests
Big Blue finds containers are speedy, but may not have much room to improve
US regulators OK sale of IBM's x86 server biz to Lenovo
Now all that remains is for gov't offices to ban the boxes
Gartner's Special Report: Should you believe the hype?
Enough hot air to carry a balloon to the Moon
Flash could be CHEAPER than SAS DISK? Come off it, NetApp
Stats analysis reckons we'll hit that point in just three years
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.