Severity:High
23 October, 2008
Summary:
- These vulnerabilities affect: All current versions of Windows
- How an attacker exploits them: By sending specially crafted network traffic
- Impact: Attacker gains complete control of your Windows computer
- What to do: Install the appropriate Microsoft patches immediately
Severity:High
23 October, 2008
Summary:
- These vulnerabilities affect: All current versions of Windows
- How an attacker exploits them: By sending specially crafted network traffic
- Impact: Attacker gains complete control of your Windows computer
- What to do: Install the appropriate Microsoft patches immediately
Exposure:
Today, Microsoft released asecurity bulletin urgent enough to warrant publication before next month’s regular Patch Day. The bulletin describes a very serious vulnerability in one of the core networking components that ships with all current versions of Windows. The vulnerability lies within the Server service; a main Windows component responsible for many of the operating system’s networking capabilities, such as network file sharing and printing. According to Microsoft, the Server service suffers from an unspecified flaw involving how it handlesRemote Procedure Call (RPC) requests. By sending a specially crafted network packet, a remote attacker could exploit this flaw to gain complete control of your Windows computers. In most cases, even an anonymous, unauthenticated attacker could exploit this vulnerability. Due to security restrictions in Microsoft’s newer products, in order to exploit this flaw against Windows Vista and Server 2008 computers, attackers would need valid Windows login credentials.
This flaw poses a critical risk to most Windows users, because attackers love to exploit these kinds of core networking flaws in massive automated attacks. Microsoft says the flaw is already being exploited in the wild, in targeted attacks. We expect to see this flaw exploited in a worm or bot client in the near future. Now that we’ve said that, though, attackers need access to TCP ports 139 and 445 in order to leverage this vulnerability. Most administrators block these ports by default at their firewall. As long as you haven’t specifically allowed Windows networking through your firewall, you don’t have to worry about external attackers exploiting this flaw. But if a bot client (or some other type of malware) sneaks onto one of your internal machines, it could easy exploit this flaw to infect the rest of your network. We give our strongest recommendation that you patch this vulnerability immediately.
Solution Path:
Microsoft has released Windows patches to correct this vulnerability. You should download, test, and deploy the appropriate patches throughout your network immediately.
- For Windows 2000
- For Windows XP
- For Windows XP x64
- For Windows Server 2003
- For Windows Server 2003 x64
- For Windows Server 2003 Itanium
- For Windows Vista
- For Windows Vista x64
- For Windows Server 2008
- For Windows Server 2008 x64
- For Windows Server 2008 Itanium
For All WatchGuard Users:
WatchGuard Fireboxes, by default, block the ports necessary to leverage this vulnerability (TCP ports 139 and 445). As long as you haven’t specifically added a policy to allow these ports, external attackers cannot exploit this vulnerability against your internal computers. However, we still recommend patching immediately to avoid the possibility of an internal attack.
Status:
Microsoft has released patches correcting this issue.
References:
- Microsoft Security Bulletin MS08-067