Risk
10/23/2008
10:05 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Microsoft's Emergency Patch

I've received a number of e-mails, and held a few conversations, today with admins upset with Microsoft's atypical out-of-cycle patch. Newsflash: This was the right thing for the company to do.

I've received a number of e-mails, and held a few conversations, today with admins upset with Microsoft's atypical out-of-cycle patch. Newsflash: This was the right thing for the company to do.First, it's been relatively rare for Microsoft to release one of these emergency patches. The last time it had to do this was April of 2007

Second, this flaw is just nasty, affects nearly every running version of Windows, is remotely exploitable, and could very well end up seeing a worm developed to target it. Time was of the essence for Microsoft to release this patch, and now time is of the essence for you to deploy it.

Microsoft Security Bulletin MS08-067 explained that this vulnerability resides in its Server service, and attackers could create specially crafted remote procedure call requests either for one-off exploits or an outright self-replicating worm.

According to Thomas Claburn's story from earlier today, attacks were already in the wild. Quoting Jason Miller, security and data team manager at patch management software maker Shavlik Technologies:

"This vulnerability is pretty nasty," said Miller. "It affects every version of the Windows operating system. Attackers don't need to have any credentials or access to the machine. They don't have to trick the user into doing anything."

His biggest fear, he said, is that a worm will be developed to take over vulnerable machines en masse. And he fully expects that to happen. "You're talking about a vulnerability that does not need user interaction," he said. "That's a gold mine if you're trying to build a botnet."

Sounds like a good enough reason for an emergency patch to me, and a great reason to test and apply ASAP.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.