Feeds

Microsoft rushes out emergency Windows security fix

'Critical' bug squashed

Internet Security Threat Report 2014

Updated Microsoft has released an emergency security update for a broad swath of its users that patches a critical security hole that is already being exploited in the wild.

The vulnerability - which has been subjected to "limited, targeted attacks" - could allow miscreants to create wormable exploits that remotely execute malicious code on vulnerable machines, Microsoft said. No interaction is required from the end user. It was the first patch released outside Microsoft's regular update cycle in 18 months.

"This is a remote code execution vulnerability," Microsoft's out-of-band advisory warned. "An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely."

The vulnerability stems from the failure of Windows server service to properly vet remote procedure call (RPC) requests for malicious content. The service handles the sharing of printers, disk and other resources over a network. It also allows applications on one networked computer to communicate with applications on another machine.

On the 2000, XP, and Server 2003 versions of Windows, anonymous users with access to the target network could exploit the weakness by sending a specially crafted network packet to the affected system. Microsoft rated the vulnerability as "critical" - its most severe designation - for those versions.

By contrast, for the exploit to work on Windows Vista and Windows 2008, only an authenticated user with access to the target network can carry out the attack. That's a testament to the work over the past few years by Microsoft's security team. Both operating systems were designed under Microsoft's secure development lifecycle initiative, which is intended to harden software against attacks.

"The good news is that Vista and later operating systems will be more difficult if not impossible to exploit automatically," Ben Greenbaum, a senior research manager at anti-virus provider Symantec said in a statement.

The vulnerability is rated "important" for users of Vista and Server 2008. The beta version of Windows 7 is also affected.

One of the defenses baked into the newer operating systems is ASLR, or address space layout randomization. It makes it hard for attackers to predict the precise memory locations their malicious code will be found.

"In the case of exploitation, it makes it harder to write an exploit that works across lots of different machines," Andrew Cushman, senior director with Microsoft's security response center, said in an interview. "You're not going to see a worm on Vista or Server 2008."

Two other defenses that lessened the severity were data execution protection, which makes it hard to execute data placed into the software stack, and user access control, the technology that allows only authenticated users to execute the code.

"We're just thrilled to see the investments we've made," Cushman said.

Not everyone in security circles was quite so sanguine. DigiTrust Group Director of Professional Services Marc Maiffret, who first spotted the vulnerability that led to the devastating Code Red worm in 2001, was surprised a bug of this magnitude hadn't been caught sooner.

"It is good that Vista and 2008 require authentication but that was a very broad thing Microsoft did," he told El Reg. "The fact that with all the money spent on code auditing and related they still simply missed an age-old hole you can drive a truck through is awesome."

Indeed, the RPC request responsible for the emergency vulnerability is identical to one that led to this one, which was patched more than two years ago, said Kostya Kortchinsky, a researcher at penetration testing firm Immunity.

This is the sixth time Microsoft has issued and out-of-band security update since October 2004 when it implemented its policy of releasing patches on the second Tuesday of each month, a company spokesman said. The last time an unscheduled patch update was issued was in April 2007 when it moved to fix a critical bug in the ANI animated cursor feature of Windows.

Thursday's bulletin also marked the second time Microsoft has offered additional vulnerability details to security providers in advance. About an hour before the patch was released publicly, members of the Microsoft Active Protections Program (MAPP) received a briefing that allowed them to create signatures that detect exploits in anti-virus software and intrusion prevention systems.

Microsoft also offered a stunning amount of detail about the vulnerability to regular Joes here.

Redmond has remained tight-lipped about the in-the-wild attacks it alluded to. Cushman said Microsoft was alerted to them "a couple weeks ago," but otherwise declined to give details. We've scoured the usual sites for exploit code and so far have found none.

Patching is painless and is as easy as selecting Start > All Programs > Windows Update. It does, however, require the machine to reboot. For those who cannot patch immediately, the above-linked Microsoft bulletin offers several work-arounds. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.