Microsoft Corp. has made available for download the first release candidate of a major security update to Windows Server 2003.
The 316MB download contains many of the changes that Windows XP Service Pack 2 brought to that operating system against buffer overflows and other common attacks, including specific support for “no execute” processors.
It also adds a new Security Configuration Wizard, which uses a role-based approach to remove unnecessary services, diminishing “the attack surface.” The wizard asks a series of questions about the tasks performed by the server and disables services unnecessary to those roles. The wizard is not installed by default.
To further tighten security on new installations, the Post-setup Security Update Wizard blocks all incoming traffic until the latest updates are applied and Automatic Updates are configured.
The Service Pack adds the Windows Firewall, perhaps the most significant addition to Windows XP SP2. The new firewall is manageable using Windows group policy. Just as with Windows XP SP2, Microsoft acknowledges that the changes in Windows Server 2003 SP1 are basic enough to the behavior of the operating system that they may affect application behavior. The company argues that the improvements are important enough that applications should be changed to accommodate them.
SP1 enhances authentication for RPC and DCOM interfaces, which have been popular avenues for attack in the past. A new Network Access Quarantine Control delays access to remote networks until the configuration of those networks has been audited. And VPN Quarantine allows the system to require that clients connecting through a virtual private network have the latest security updates. Finally, an auditing capability has been added for the IIS Metabase, the XML-based data store for the Internet Information Server Web server.