Security Experts Warn of New Way to Attack Windows
Exploit enables an attacker to compromise a number of machines at one time and could lead to the creation of another fast-spreading Windows worm, caution experts.Security experts have found a new way to exploit a critical vulnerability in Windows that evades a workaround and enables the attacker to compromise a number of machines at one time. The new attack could also lead to the creation of another fast-spreading Windows worm, the experts warned. The workaround in question is for the buffer overrun flaw in the Windows Workstation Service, which is enabled by default in Windows 2000 and XP. An attacker who successfully exploits the weakness could run any code of choice on the vulnerable machine. Microsoft Corp. issued a patch for the vulnerability in November, but the security bulletin also listed several workarounds for the flaw, including disabling the Workstation Service and using a firewall to block specific UDP and TCP ports. But penetration testers at Core Security Technologies, a Boston-based security company, discovered a new attack vector that uses a different UDP port. This attack still allows the malicious packets to reach the vulnerable Workstation Service.
The attack takes advantage of several characteristics of the UDP protocol. Unlike TCP, UDP is "connectionless," meaning that there is no TCP-style handshake, and you need not establish a connection with a remote machine in order to send a UDP packet. Also, because the Internets DNS service uses the protocol, UDP packets usually have no trouble traversing firewalls.