RSSOut-of-band security patch addresses critical Windows vulnerability
By Scott M. Fulton, III | Published October 23, 2008, 5:59 PM
It's a part of Windows that handles all the file and print sharing services over any network. Today, Microsoft decided to take the unusual step of issuing a patch for a vulnerability on this part now, and not wait until November 11.
The part of Windows known as the Server service -- the component responsible for handling file sharing, print sharing, and pipelining between computers -- has been hit once again with an exploit whose profile resembles an August 2006 problem patched the following month. But this time, Microsoft is announcing it received information about this latest exploit privately, indicating that unlike the older incident, Microsoft was working to pre-empt any possibility of the exploit making its way into the wild.
A patch is already being issued, just over two weeks from Microsoft's usual Patch Tuesday release period. Though it could have remained silent for another few weeks, the company chose to act now.
Essentially all versions of Windows are affected by this vulnerability, including those patched by service packs, and including all versions of Vista and Windows Server 2008 -- for x86, x64, and Itanium-based systems. Everything made this decade with the "Windows" brand requires this patch.
Just as before, the list of services that could be affected by this latest hole, is astounding. Most importantly, anything that relies on Server Message Block (SMB) including the Common Internet File System (CIFS), any kind of file or print sharing, remote group policy enforcement, the print spooler, the indexing service, and network logon -- all of these are among the items impacted by a potential hijacking of the Server service. Essentially, anything that need sharing or to be shared goes through the SMB protocol, which is managed by the Server service.
Exactly how an exploit would manage to gain control of the SMB protocol in this instance has not been revealed, for obvious reasons. Microsoft's vague description essentially says that a maliciously crafted remote procedure call from a source that is authenticated as the Server service (it has to be authenticated first) can trigger a situation where arbitrary code can then be executed without authentication.
In lieu of applying the patch, Microsoft's suggested list of workarounds is not pretty. For instance, for Vista users, the company advised that the Windows Firewall is a very handy tool for turning off visibility of one's computer -- effectively removing it from even a local network. For admins, Microsoft details how they can write filtering rules that effectively eliminate any traffic from services that have been authenticated as the Server service.
A check of the UID of that service -- the key used to authenticate it -- reveals a long history of not just exploits, but attempts at exploits. In 2006, it was learned that when a component places a remote procedure call using the authenticated Server service interface, the stub that's returned -- in COM-speak, the handle of what's being requested -- contains way too much data. Included to that data was an open pointer to the heap, that remote components should not have.
In early Microsoft security models, the way COM traffic was passed was by authenticating the interface through which it was passed, under the theory that it wouldn't be using the interface unless it had permission to do so. In the Component Object Model, an "interface" is more like a logical template through which data is passed; anything read through the interface takes the form specified by the template, which is pointed to in the System Registry. So in short, the presumption was if a component could use an interface, it was probably because it should.
That security model has long since been deprecated; but in the interim, Microsoft has found itself struggling to overcome the security assumptions created by the old COM way of "remoting." If today's exploit is similar, a private security researcher (thus far uncredited) may have discovered yet another way to use the unnecessary bounty of information a stub can return when an RPC is placed using SMB protocol.
There does not appear to be evidence that a working exploit is active and in the wild at this time, though based on what evidence BetaNews did turn up today, one could be close.
DIAF spammer.
Score: 0
|Has anyone else had any problems with this patch? Two of my clients could no longer connect (could not get DHCP address from router) after the patch. Functionality returned after uninstalling the patch.
I guess that's a security fix. Hose the internet connection, and you can't get hacked...
Score: 0
|Vista SP1 x64 is the best OS out there. Far more superior than crap OS X :) SP2 is just around the corner.
Score: 0
|SP2 is just around the corner.
News to me...where'd you hear that?
Score: 0
|Yeah, of course it is Shelly!
It's called that soon to be that number that is now copyright "7".
And, no Vista x64 is not the best OS out there, it's good, but the best is still the one Toolie pointed me to, eXPerience XP built on the Server 2003 RC2, yep still have that, but everytime I upload the links to RS/MU they last about 2 days.
Should you find a viable link, 2 tricks (pardon the pun), allow previous versions & the I hate so say it, but the Patin-Coufin driver.
Whilst I'm still legless, i'll make an observatiin, do not own a desktop, typing this on a Dell XPS M1530,running x64, geez the page file 6192mb and attendant gabage are most curious indeed.
Score: 0
|http://www.neowin.net/ne...beta-release-in-4-weeks
Score: 0
|Perhaps, dummy you should look around. Think it may be called "se7en".
Chortle!
Score: 0
|Thanks for the link. :)
Score: 0
|Hot news: There will even be an option to boot Windows 7 in even 8 seconds or so, but some features will be unavailable via that option :P
Score: 0
|They're already doing it with Linux. Hell, it's already built into some mainboards.
Check out Express Gate.
Not the most reliable or even functional on many motherboards, when done properly, it's pretty damned useful stuff.
Score: 0
|Vista Ultimate SP1 FTW, i had doubts when i switched from XP Pro... but its been rock solid, no regrets
Score: 0
|I too was shocked how much I actually like Vista Ultimate. I installed it (not upgraded) on my Windows MCE2005 box. Holy cow - it's awesome. Media Center is the jewel which MS should promote more. I thought it was going to be slower than XP -- I was wrong. It's snappy. clean looking. had all my drivers out of the box (updated versions were found in Windows Update). Not a single crash or lock up or anything weird. It's been a good experience.
I thought I was running Mojave!!!
Score: 0
|Crap OS X? That's the worst OS I have ever seen.
Score: 0
|FYI, we were told in our con-call with Microsoft today that the Client versions of this exploit DO NOT REQUIRE the source to be authenticated, only the Server versions need the source server service to be authenticated.
Score: 0
|LOL. I'm sorry, why do I use Mac OS X again? ^_^
Score: 0
|Oh, that's right!
Because I can't be bothered to think for myself. I just let someone else tell me what hardware is best, what software is best, what programs I can have on my phone and what music I can listen to.
Oh!
And then I hop on ,my little Mac-y-poo and tell the world what a good little sheeple I am so that Mr. Jobs won't have to cry every night. (Because he knows when I've been a bad boy)
Score: 0
|At least you admit you have a problem, its the first step...congrats.
Score: 0
|It's pretty obvious you're a POS BetaNews admin or hacker that is abusively using my username but that's ok though. What else can I expect from a Windoze user except criminal and juvenile behavior.
Score: 0
|You slow twat. The L in your username has been replaced by a capital i.
It's a different username. Quit your whining.
Score: 0
|lol, that was awesome... them mac users aren't too bright.
Score: 0
|Heh..
Captain Obvious to the rescue, folks!
Score: 0
|Actually it's a known exploit of OSX. If I was you I'd carry my Mac to an Apple Guru and let it be fixed while slurping an espresso...
Score: 0
|*laughing*
What? You've got the market on BS cornered?
Can't really see the difference between you and your doppelganger other than choice of company to subject to your sycophantic delusions.
Score: 0
|Please don't judge a group by it's poorest example. Thank you. :)
Score: 0
|Eh..?
*googling*...
Ah, nice word! I am gonna make you my word a day hero for this week.
Score: 0
|*laughs*
I figured that might get more than a few double-takes. ;)
Score: 0
|try changing your password you nitwit.
Score: 0
|IW7,
Are ya a dummy, one of your alt's woud't be Pitmongrel would it?
My Cake Cutter, is still sitting over the other side of my lounge room' still spinnin' out somewhat like me, yeah may you laugh.
Created an nLite XP Pro SP3, and decided to test on the MBA, Win partition, and what can I other than whre I'm going to be frying my eggs in a couple of hours.
Score: 0
|Is it a bad sign that I knew right off what you meant?
Score: 0
|Depends. Is a wide vocabulary a bad thing or a good thing?
Score: 0
|Going by the reactions of many people who are offended when I use a word they don't know, it seems more of a bad thing. Rather than actually learning something and improving their vocabulary and such, they don't feel like making the effort and instead insist that I speak "at their level". Techs should know right off what I mean.
Score: 0
|Well I could have sworn I was smarter than that. I mean after all, I do use the Greatest OS Man Has Ever Witnessed: Microsoft Windows Vista.
One would think I could sniff out a ruse as simple as this.
Perhaps I am not the all-knowing loyal acolyte of the Gods I thought I was.
Nah. Couldn't be that.
Score: 0
|Ok, how about 'them mac users aren't too bright, except for TheNewGuy'. Better?
Score: 0
|Go make the effort. Some of us only picked up English after a few other languages so we are well aware of our deficiencies in comparison...
Score: 0
|because of windows problems my dell is not locked and can not download. it will probable go into the trash. i will buy an apple. i just pray they can transfer my data.
Score: 0
|Smart man. You won't regret it. I switched almost one year to the day and I love it. I just wish I had got a Mac much sooner. As far as your files are concerned, that won't be a problem for a Mac Genius to take care of that for you. They'll do that for free when you buy a new Mac.
A Mac is everything Winblows is not, elegant, intuitive, secure, incredibly stable and simply the most advanced OS of any platform. Once you go Mac, you won't go back. :)
Score: 0
|Yeah, I'm looking to buy an Apple too. Unfortunately I've been saving since 2005 and I still haven't got enough for their basic machine. Even if I hadn't bought 3 PCs in that time, I still wouldn't have enough.
Damn. :(
Score: 0
|Sounds like a welfare case to me. :)
Score: 0
|"A Mac is everything Winblows is not, elegant, intuitive, secure, incredibly stable and simply the most advanced OS of any platform. Once you go Mac, you won't go back."
Elegance is a matter of opinion. I prefer the look of Vista to OSX.
Intuitive? Unless you're a monkey looking for the banana button, it's all about what you're used to.
Security...do you truly think OSX has no flaws? There will be a day when OSX reaches that critical point when the s*** storm begins. Until then hackers will continue to assault the OS with the leading market share.
Stability...I've manage to crash Vista x64 one time(and one time only) by using a 3rd party FOSS app. I'm willing to bet you've achieved at least this number, if not more. (or alternately simply do a search using your favorite search engine for OSX crash). I've managed to crash my Ubuntu x86 and x64 many orders of magnitude more.
OSX, crash different.
Score: 0
|3 years?? You're joking obviously (or I sure hope you are).
*boggleboggle*
Score: 0
|"Once you go Mac, you won't go back."
Until you realize you can't do as much on a PC. For example games.
Score: 0
|"Everything made this decade with the "Windows" brand requires this patch."
Windows ME?
Or are we all still trying to forget that existed?
Score: 0
|Let's just say that one has bigger problems than this vulnerability if running Windows ME.
Score: 0
|It pays the bills. Thanks Microsoft.
Score: 0
|Yawn...
Score: 0
|Microsoft always works to pre-empt such attacks. The only times they let such things slide is when they know it won't affect anyone of importance.
Microsoft steps up once again to protect us all from those who would use their OS to do harm to others.
I've said it before and I'll say it again, Microsoft is the Best Company Ever, and anyone who thinks otherwise is obviously only doing so because they do not feel worthy.
Score: 0
|What the hell are you talking about?!?!
Score: 0
|Which part of the message is it that you don't understand or are you trying to be a smartass?
Score: 0
|LOL. Nice try at stealing my username and posting pro-M$ BS. Obviously I view M$ as a shot company on the decline.
Score: 0
|Sorry guys, I had a few typo's there.
I meant to say:
LOL. It's so nice now that I've finally seen the light. Obviously I now know that Microsoft is The Company in which to invest one's loyalty and can only continue to improve an already amazing portfolio of software.
A horrible typo, you say? It was a simple mistake, the keys being so close an all.
Score: 0
|internetworId7 has never said anything nice about Microsoft and probably wouldn't even with a gun to his head and the trigger being pulled. Someone is spoofing him.
Ever notice that one could use a capital i and have it look like a lowercase L?
Score: 0
|Despite MS being the LARGEST Mac developer - even larger than Apple.
Bite it i7.
Score: 0
|Too funny. Now that's the best piece of sarcasm I've seen in the last 5 minutes.
Score: 0
|Bingo.
We have a winner!
Frankly, I'm a shocked and amazed no-one else thought of this first.
Score: 0
|I am only too eager to supply you with just as much Microsoft BS as my doppelganger desires to supply us with Apple BS.
No thanks are necessary, and you are very welcome.
Score: 0
|