Feeds

Microsoft rushes out emergency Windows security fix

'Critical' bug squashed

Using blade systems to cut costs and sharpen efficiencies

Updated Microsoft has released an emergency security update for a broad swath of its users that patches a critical security hole that is already being exploited in the wild.

The vulnerability - which has been subjected to "limited, targeted attacks" - could allow miscreants to create wormable exploits that remotely execute malicious code on vulnerable machines, Microsoft said. No interaction is required from the end user. It was the first patch released outside Microsoft's regular update cycle in 18 months.

"This is a remote code execution vulnerability," Microsoft's out-of-band advisory warned. "An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely."

The vulnerability stems from the failure of Windows server service to properly vet remote procedure call (RPC) requests for malicious content. The service handles the sharing of printers, disk and other resources over a network. It also allows applications on one networked computer to communicate with applications on another machine.

On the 2000, XP, and Server 2003 versions of Windows, anonymous users with access to the target network could exploit the weakness by sending a specially crafted network packet to the affected system. Microsoft rated the vulnerability as "critical" - its most severe designation - for those versions.

By contrast, for the exploit to work on Windows Vista and Windows 2008, only an authenticated user with access to the target network can carry out the attack. That's a testament to the work over the past few years by Microsoft's security team. Both operating systems were designed under Microsoft's secure development lifecycle initiative, which is intended to harden software against attacks.

"The good news is that Vista and later operating systems will be more difficult if not impossible to exploit automatically," Ben Greenbaum, a senior research manager at anti-virus provider Symantec said in a statement.

The vulnerability is rated "important" for users of Vista and Server 2008. The beta version of Windows 7 is also affected.

One of the defenses baked into the newer operating systems is ASLR, or address space layout randomization. It makes it hard for attackers to predict the precise memory locations their malicious code will be found.

"In the case of exploitation, it makes it harder to write an exploit that works across lots of different machines," Andrew Cushman, senior director with Microsoft's security response center, said in an interview. "You're not going to see a worm on Vista or Server 2008."

Two other defenses that lessened the severity were data execution protection, which makes it hard to execute data placed into the software stack, and user access control, the technology that allows only authenticated users to execute the code.

"We're just thrilled to see the investments we've made," Cushman said.

Not everyone in security circles was quite so sanguine. DigiTrust Group Director of Professional Services Marc Maiffret, who first spotted the vulnerability that led to the devastating Code Red worm in 2001, was surprised a bug of this magnitude hadn't been caught sooner.

"It is good that Vista and 2008 require authentication but that was a very broad thing Microsoft did," he told El Reg. "The fact that with all the money spent on code auditing and related they still simply missed an age-old hole you can drive a truck through is awesome."

Indeed, the RPC request responsible for the emergency vulnerability is identical to one that led to this one, which was patched more than two years ago, said Kostya Kortchinsky, a researcher at penetration testing firm Immunity.

This is the sixth time Microsoft has issued and out-of-band security update since October 2004 when it implemented its policy of releasing patches on the second Tuesday of each month, a company spokesman said. The last time an unscheduled patch update was issued was in April 2007 when it moved to fix a critical bug in the ANI animated cursor feature of Windows.

Thursday's bulletin also marked the second time Microsoft has offered additional vulnerability details to security providers in advance. About an hour before the patch was released publicly, members of the Microsoft Active Protections Program (MAPP) received a briefing that allowed them to create signatures that detect exploits in anti-virus software and intrusion prevention systems.

Microsoft also offered a stunning amount of detail about the vulnerability to regular Joes here.

Redmond has remained tight-lipped about the in-the-wild attacks it alluded to. Cushman said Microsoft was alerted to them "a couple weeks ago," but otherwise declined to give details. We've scoured the usual sites for exploit code and so far have found none.

Patching is painless and is as easy as selecting Start > All Programs > Windows Update. It does, however, require the machine to reboot. For those who cannot patch immediately, the above-linked Microsoft bulletin offers several work-arounds. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.