Feeds

Microsoft rushes out emergency Windows security fix

'Critical' bug squashed

Top 5 reasons to deploy VMware with Tegile

Updated Microsoft has released an emergency security update for a broad swath of its users that patches a critical security hole that is already being exploited in the wild.

The vulnerability - which has been subjected to "limited, targeted attacks" - could allow miscreants to create wormable exploits that remotely execute malicious code on vulnerable machines, Microsoft said. No interaction is required from the end user. It was the first patch released outside Microsoft's regular update cycle in 18 months.

"This is a remote code execution vulnerability," Microsoft's out-of-band advisory warned. "An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely."

The vulnerability stems from the failure of Windows server service to properly vet remote procedure call (RPC) requests for malicious content. The service handles the sharing of printers, disk and other resources over a network. It also allows applications on one networked computer to communicate with applications on another machine.

On the 2000, XP, and Server 2003 versions of Windows, anonymous users with access to the target network could exploit the weakness by sending a specially crafted network packet to the affected system. Microsoft rated the vulnerability as "critical" - its most severe designation - for those versions.

By contrast, for the exploit to work on Windows Vista and Windows 2008, only an authenticated user with access to the target network can carry out the attack. That's a testament to the work over the past few years by Microsoft's security team. Both operating systems were designed under Microsoft's secure development lifecycle initiative, which is intended to harden software against attacks.

"The good news is that Vista and later operating systems will be more difficult if not impossible to exploit automatically," Ben Greenbaum, a senior research manager at anti-virus provider Symantec said in a statement.

The vulnerability is rated "important" for users of Vista and Server 2008. The beta version of Windows 7 is also affected.

One of the defenses baked into the newer operating systems is ASLR, or address space layout randomization. It makes it hard for attackers to predict the precise memory locations their malicious code will be found.

"In the case of exploitation, it makes it harder to write an exploit that works across lots of different machines," Andrew Cushman, senior director with Microsoft's security response center, said in an interview. "You're not going to see a worm on Vista or Server 2008."

Two other defenses that lessened the severity were data execution protection, which makes it hard to execute data placed into the software stack, and user access control, the technology that allows only authenticated users to execute the code.

"We're just thrilled to see the investments we've made," Cushman said.

Not everyone in security circles was quite so sanguine. DigiTrust Group Director of Professional Services Marc Maiffret, who first spotted the vulnerability that led to the devastating Code Red worm in 2001, was surprised a bug of this magnitude hadn't been caught sooner.

"It is good that Vista and 2008 require authentication but that was a very broad thing Microsoft did," he told El Reg. "The fact that with all the money spent on code auditing and related they still simply missed an age-old hole you can drive a truck through is awesome."

Indeed, the RPC request responsible for the emergency vulnerability is identical to one that led to this one, which was patched more than two years ago, said Kostya Kortchinsky, a researcher at penetration testing firm Immunity.

This is the sixth time Microsoft has issued and out-of-band security update since October 2004 when it implemented its policy of releasing patches on the second Tuesday of each month, a company spokesman said. The last time an unscheduled patch update was issued was in April 2007 when it moved to fix a critical bug in the ANI animated cursor feature of Windows.

Thursday's bulletin also marked the second time Microsoft has offered additional vulnerability details to security providers in advance. About an hour before the patch was released publicly, members of the Microsoft Active Protections Program (MAPP) received a briefing that allowed them to create signatures that detect exploits in anti-virus software and intrusion prevention systems.

Microsoft also offered a stunning amount of detail about the vulnerability to regular Joes here.

Redmond has remained tight-lipped about the in-the-wild attacks it alluded to. Cushman said Microsoft was alerted to them "a couple weeks ago," but otherwise declined to give details. We've scoured the usual sites for exploit code and so far have found none.

Patching is painless and is as easy as selecting Start > All Programs > Windows Update. It does, however, require the machine to reboot. For those who cannot patch immediately, the above-linked Microsoft bulletin offers several work-arounds. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.