Microsoft confirms the existence of a bug in Windows Server 2008, Windows Vista and release candidates of Windows 7 that could be used to hijack PCs. While users await a patch, there are a few steps they can take to protect themselves.
Hours after its latest
Patch
Tuesday release, Microsoft confirmed the presence of a serious
zero-day bug in Windows Vista, Windows Server 2008 and release candidates
of Windows 7.
The vulnerability, which lies in Windows' SMB (Server Message Block)
2, is due to the SMB implementation improperly parsing SMB negotiation
requests. As of yesterday, Microsoft reported the flaw had not been the subject
of attacks, but that could change as exploit code has been publicly available
since Monday.
"An attacker who successfully exploited this vulnerability could take
complete control of an affected system," Microsoft's advisory said.
"Most attempts to exploit this vulnerability will cause an affected system
to stop responding and restart."
While Microsoft officials said the company is working on a patch, they
offered no timeline as to when it would be available. While users wait, the
company
recommends they disable SMB 2 via the Windows Registry Editor or block
TCP ports
139 and 445 at the firewall. Both those workarounds, however, come with
drawbacks. A mistake in the Registry Editor could force a user
to reinstall Windows, while blocking ports 139 and 445 could stop
applications from working.
The issue first came to light Monday when a researcher claimed he used
it to trigger the infamous "Blue Screen of Death" on Windows Vista
and Windows 7. Other researchers subsequently used the bug to crash other
versions of Windows. After a day of investigation, Microsoft announced late
Tuesday that the flaw was real, and reported it could not only cause a
denial-of-service condition but could also be used to take over a system.
According to Microsoft,
the Windows 7 RTM (release to manufacturing), Windows 2000, XP and Windows
Server 2008 R2 are not affected by this vulnerability.
In addition to the latest zero-day, Microsoft has
promised
to fix a flaw in the file transfer protocol (FTP) service utilized by
Internet Information Services (IIS). The flaw has come under attack by
hackers, and Windows users are advised to leverage the information on
workarounds and
mitigations provided by Microsoft.
Email
Print
