Feeds

Microsoft rushes out emergency Windows security fix

'Critical' bug squashed

Choosing a cloud hosting partner with confidence

Updated Microsoft has released an emergency security update for a broad swath of its users that patches a critical security hole that is already being exploited in the wild.

The vulnerability - which has been subjected to "limited, targeted attacks" - could allow miscreants to create wormable exploits that remotely execute malicious code on vulnerable machines, Microsoft said. No interaction is required from the end user. It was the first patch released outside Microsoft's regular update cycle in 18 months.

"This is a remote code execution vulnerability," Microsoft's out-of-band advisory warned. "An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely."

The vulnerability stems from the failure of Windows server service to properly vet remote procedure call (RPC) requests for malicious content. The service handles the sharing of printers, disk and other resources over a network. It also allows applications on one networked computer to communicate with applications on another machine.

On the 2000, XP, and Server 2003 versions of Windows, anonymous users with access to the target network could exploit the weakness by sending a specially crafted network packet to the affected system. Microsoft rated the vulnerability as "critical" - its most severe designation - for those versions.

By contrast, for the exploit to work on Windows Vista and Windows 2008, only an authenticated user with access to the target network can carry out the attack. That's a testament to the work over the past few years by Microsoft's security team. Both operating systems were designed under Microsoft's secure development lifecycle initiative, which is intended to harden software against attacks.

"The good news is that Vista and later operating systems will be more difficult if not impossible to exploit automatically," Ben Greenbaum, a senior research manager at anti-virus provider Symantec said in a statement.

The vulnerability is rated "important" for users of Vista and Server 2008. The beta version of Windows 7 is also affected.

One of the defenses baked into the newer operating systems is ASLR, or address space layout randomization. It makes it hard for attackers to predict the precise memory locations their malicious code will be found.

"In the case of exploitation, it makes it harder to write an exploit that works across lots of different machines," Andrew Cushman, senior director with Microsoft's security response center, said in an interview. "You're not going to see a worm on Vista or Server 2008."

Two other defenses that lessened the severity were data execution protection, which makes it hard to execute data placed into the software stack, and user access control, the technology that allows only authenticated users to execute the code.

"We're just thrilled to see the investments we've made," Cushman said.

Not everyone in security circles was quite so sanguine. DigiTrust Group Director of Professional Services Marc Maiffret, who first spotted the vulnerability that led to the devastating Code Red worm in 2001, was surprised a bug of this magnitude hadn't been caught sooner.

"It is good that Vista and 2008 require authentication but that was a very broad thing Microsoft did," he told El Reg. "The fact that with all the money spent on code auditing and related they still simply missed an age-old hole you can drive a truck through is awesome."

Indeed, the RPC request responsible for the emergency vulnerability is identical to one that led to this one, which was patched more than two years ago, said Kostya Kortchinsky, a researcher at penetration testing firm Immunity.

This is the sixth time Microsoft has issued and out-of-band security update since October 2004 when it implemented its policy of releasing patches on the second Tuesday of each month, a company spokesman said. The last time an unscheduled patch update was issued was in April 2007 when it moved to fix a critical bug in the ANI animated cursor feature of Windows.

Thursday's bulletin also marked the second time Microsoft has offered additional vulnerability details to security providers in advance. About an hour before the patch was released publicly, members of the Microsoft Active Protections Program (MAPP) received a briefing that allowed them to create signatures that detect exploits in anti-virus software and intrusion prevention systems.

Microsoft also offered a stunning amount of detail about the vulnerability to regular Joes here.

Redmond has remained tight-lipped about the in-the-wild attacks it alluded to. Cushman said Microsoft was alerted to them "a couple weeks ago," but otherwise declined to give details. We've scoured the usual sites for exploit code and so far have found none.

Patching is painless and is as easy as selecting Start > All Programs > Windows Update. It does, however, require the machine to reboot. For those who cannot patch immediately, the above-linked Microsoft bulletin offers several work-arounds. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?