On February 10, Microsoft disclosed a dangerous vulnerability in all modern versions of Windows, along with a patch to fix it. Nine days may not seem like a long time, but every day that goes by without a real exploit is great news.
/zimages/3/28571.gifClick herefor Microsofts advisory and links to the patches)
At the same time, there is an exploit out in the wild that performs a distributed denial-of-service by crashing the attacked system. DDoS attacks are a bad thing, of course, but they arent as much of a worry from a mass-attack standpoint. Authors cant make a worm out of a DDoS attack because if the system crashes, theres scant opportunity to trick the owner into spreading the worm.
A real worm requires a means of infection and the ability to execute arbitrary code on the infected system. The Microsoft advisory indicates that this is possible with the ASN.1 issue.
There have been allegations that the claim of arbitrary code execution is an exaggeration, however, experts advised me that a code execution worm is merely difficult, but not impossible. Given a large number of vulnerable systems in the world, such a worm could still spread.
/zimages/3/28571.gif
Heres what its all about: Without getting too specific, its not possible to write a reliable exploit that gains control of the target system.
According to Ken Dunham, director of malicious code at iDEFENSE, “The heap overflow exploit is proving to be more difficult for some attackers than what they had originally thought. A change of state makes it more difficult to successfully exploit computers.”
In other words, the attack requires conditions on the PC which cannot be predicted or controlled by the attacker.
But even if, for the sake of argument, only 1 percent of attacks succeed, that would encompass enough computers for the worm to spread far, assuming it wont do serious damage to systems that it cant successfully infect. The worm will keep trying and trying and eventually, it will get through— if there are enough unpatched systems for it to find.
Meanwhile, if unsuccessful attacks crash the system or do something else to tip the owner off of the worms presence, the jig will soon be up.
Next Page: What About Windows 98?
What About Windows 98
?
Theres an interesting sidebar to this problem: Microsofts advisory mentions only Windows NT and descendent products, not Win9x. But others have shown that vulnerable ASN.1 code is present on Windows 9x systems.
Reports to the Bugtraq mailing list have indicated that Microsoft has a fix for Windows 98 (and, presumably, for Windows ME, although I havent seen it mentioned). However, its only available if you have a current support contract for Windows 98 and request the patch from Microsoft through official channels.
Microsoft confirmed this claim.
According to Matt Pilla, senior product manager in the Windows Client group, the “patch for the ASN.1 vulnerability is available through Microsoft Product Support Services for Windows 98 customers. We continuously evaluate our product update distribution policies in order to best meet the needs of our customers.”
Now, this approach to the ASN.1 problem is troublesome. Now, I understand that Microsoft doesnt want people to be using Window 98—and from a security standpoint, neither do I—and the company doesnt want to encourage these customers with the hint of support. Yet if Microsoft wants to prevent exploits of this particular vulnerability from gaining any traction in the world and stop ASN.1 from becoming a continuous problem—like too many others before it—then the company needs to get patches out quickly to as many vulnerable systems as possible. There are still a lot of Windows 98 systems in operation. As evidence, some 24 percent of the systems used to access Google in January were from Windows 98 machines. No doubt, a very large number of them are vulnerable to a ASN.1 attack.
/zimages/3/28571.gifCheck outeWEEK.coms Windows Centerat http:windows.eweek.com for Microsoft and Windows news, views and analysis.
When I first heard of the ASN.1 vulnerability, I worried we would relive Blaster all over again. But now, even with the Windows 98 problems, Im less pessimistic.
As Dunham said, corporate administrators know by now that prompt patching, at least at the perimeter of the network, is an urgent matter at times like this. In addition, its likely that there are few unpatched corporate networks to attack.
Then again, there will still be many unpatched machines in consumer hands, and an attack will spread there. Still, as each day goes by, the likelihood that ASN.1 will be a serious threat goes down.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Be sure to check outeWEEK.coms Security Centerat http://security.eweek.com for the latest security news, views and analysis.
More from Larry Seltzer