Feeds

Microsoft rushes out emergency Windows security fix

'Critical' bug squashed

Choosing a cloud hosting partner with confidence

Updated Microsoft has released an emergency security update for a broad swath of its users that patches a critical security hole that is already being exploited in the wild.

The vulnerability - which has been subjected to "limited, targeted attacks" - could allow miscreants to create wormable exploits that remotely execute malicious code on vulnerable machines, Microsoft said. No interaction is required from the end user. It was the first patch released outside Microsoft's regular update cycle in 18 months.

"This is a remote code execution vulnerability," Microsoft's out-of-band advisory warned. "An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely."

The vulnerability stems from the failure of Windows server service to properly vet remote procedure call (RPC) requests for malicious content. The service handles the sharing of printers, disk and other resources over a network. It also allows applications on one networked computer to communicate with applications on another machine.

On the 2000, XP, and Server 2003 versions of Windows, anonymous users with access to the target network could exploit the weakness by sending a specially crafted network packet to the affected system. Microsoft rated the vulnerability as "critical" - its most severe designation - for those versions.

By contrast, for the exploit to work on Windows Vista and Windows 2008, only an authenticated user with access to the target network can carry out the attack. That's a testament to the work over the past few years by Microsoft's security team. Both operating systems were designed under Microsoft's secure development lifecycle initiative, which is intended to harden software against attacks.

"The good news is that Vista and later operating systems will be more difficult if not impossible to exploit automatically," Ben Greenbaum, a senior research manager at anti-virus provider Symantec said in a statement.

The vulnerability is rated "important" for users of Vista and Server 2008. The beta version of Windows 7 is also affected.

One of the defenses baked into the newer operating systems is ASLR, or address space layout randomization. It makes it hard for attackers to predict the precise memory locations their malicious code will be found.

"In the case of exploitation, it makes it harder to write an exploit that works across lots of different machines," Andrew Cushman, senior director with Microsoft's security response center, said in an interview. "You're not going to see a worm on Vista or Server 2008."

Two other defenses that lessened the severity were data execution protection, which makes it hard to execute data placed into the software stack, and user access control, the technology that allows only authenticated users to execute the code.

"We're just thrilled to see the investments we've made," Cushman said.

Not everyone in security circles was quite so sanguine. DigiTrust Group Director of Professional Services Marc Maiffret, who first spotted the vulnerability that led to the devastating Code Red worm in 2001, was surprised a bug of this magnitude hadn't been caught sooner.

"It is good that Vista and 2008 require authentication but that was a very broad thing Microsoft did," he told El Reg. "The fact that with all the money spent on code auditing and related they still simply missed an age-old hole you can drive a truck through is awesome."

Indeed, the RPC request responsible for the emergency vulnerability is identical to one that led to this one, which was patched more than two years ago, said Kostya Kortchinsky, a researcher at penetration testing firm Immunity.

This is the sixth time Microsoft has issued and out-of-band security update since October 2004 when it implemented its policy of releasing patches on the second Tuesday of each month, a company spokesman said. The last time an unscheduled patch update was issued was in April 2007 when it moved to fix a critical bug in the ANI animated cursor feature of Windows.

Thursday's bulletin also marked the second time Microsoft has offered additional vulnerability details to security providers in advance. About an hour before the patch was released publicly, members of the Microsoft Active Protections Program (MAPP) received a briefing that allowed them to create signatures that detect exploits in anti-virus software and intrusion prevention systems.

Microsoft also offered a stunning amount of detail about the vulnerability to regular Joes here.

Redmond has remained tight-lipped about the in-the-wild attacks it alluded to. Cushman said Microsoft was alerted to them "a couple weeks ago," but otherwise declined to give details. We've scoured the usual sites for exploit code and so far have found none.

Patching is painless and is as easy as selecting Start > All Programs > Windows Update. It does, however, require the machine to reboot. For those who cannot patch immediately, the above-linked Microsoft bulletin offers several work-arounds. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.