Risk
10/23/2008
10:05 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Microsoft's Emergency Patch

I've received a number of e-mails, and held a few conversations, today with admins upset with Microsoft's atypical out-of-cycle patch. Newsflash: This was the right thing for the company to do.

I've received a number of e-mails, and held a few conversations, today with admins upset with Microsoft's atypical out-of-cycle patch. Newsflash: This was the right thing for the company to do.First, it's been relatively rare for Microsoft to release one of these emergency patches. The last time it had to do this was April of 2007

Second, this flaw is just nasty, affects nearly every running version of Windows, is remotely exploitable, and could very well end up seeing a worm developed to target it. Time was of the essence for Microsoft to release this patch, and now time is of the essence for you to deploy it.

Microsoft Security Bulletin MS08-067 explained that this vulnerability resides in its Server service, and attackers could create specially crafted remote procedure call requests either for one-off exploits or an outright self-replicating worm.

According to Thomas Claburn's story from earlier today, attacks were already in the wild. Quoting Jason Miller, security and data team manager at patch management software maker Shavlik Technologies:

"This vulnerability is pretty nasty," said Miller. "It affects every version of the Windows operating system. Attackers don't need to have any credentials or access to the machine. They don't have to trick the user into doing anything."

His biggest fear, he said, is that a worm will be developed to take over vulnerable machines en masse. And he fully expects that to happen. "You're talking about a vulnerability that does not need user interaction," he said. "That's a gold mine if you're trying to build a botnet."

Sounds like a good enough reason for an emergency patch to me, and a great reason to test and apply ASAP.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio