Hours after its latest Patch Tuesday release, Microsoft confirmed the presence of a serious zero-day bug in Windows Vista, Windows Server 2008 and release candidates of Windows 7.
The vulnerability, which lies in Windows’ SMB (Server Message Block) 2, is due to the SMB implementation improperly parsing SMB negotiation requests. As of yesterday, Microsoft reported the flaw had not been the subject of attacks, but that could change as exploit code has been publicly available since Monday.
“An attacker who successfully exploited this vulnerability could take complete control of an affected system,” Microsoft’s advisory said. “Most attempts to exploit this vulnerability will cause an affected system to stop responding and restart.”
While Microsoft officials said the company is working on a patch, they offered no timeline as to when it would be available. While users wait, the company recommends they disable SMB 2 via the Windows Registry Editor or block TCP ports 139 and 445 at the firewall. Both those workarounds, however, come with drawbacks. A mistake in the Registry Editor could force a user to reinstall Windows, while blocking ports 139 and 445 could stop applications from working.
The issue first came to light Monday when a researcher claimed he used it to trigger the infamous “Blue Screen of Death” on Windows Vista and Windows 7. Other researchers subsequently used the bug to crash other versions of Windows. After a day of investigation, Microsoft announced late Tuesday that the flaw was real, and reported it could not only cause a denial-of-service condition but could also be used to take over a system.
According to Microsoft, the Windows 7 RTM (release to manufacturing), Windows 2000, XP and Windows Server 2008 R2 are not affected by this vulnerability.
In addition to the latest zero-day, Microsoft has promised to fix a flaw in the file transfer protocol (FTP) service utilized by Internet Information Services (IIS). The flaw has come under attack by hackers, and Windows users are advised to leverage the information on workarounds andmitigations provided by Microsoft.