Microsoft updates critical SMB server flaws |
 |
By Robert Westervelt, News Editor
13 Jan 2009 | SearchSecurity.com |
|
|
Microsoft issued a single security update Tuesday, patching critical flaws in the Server Message Block (SMB) that could be exploited by an attacker to access sensitive data or create a new account with full user rights.
|
| SearchSecurity.com: |
| To get security news and tips delivered to your inbox, click here to sign up for our free newsletter. |
|
|
|
|
The update addressed two critical remote code execution vulnerabilities and a denial-of-service flaw in the way the server handles SMB packets. An attacker could pass a message with malicious code to a computer running the server service. Microsoft said an attacker would not require authentication to exploit the flaw.
Paul Henry, security and forensic analyst at patch management vendor Lumension Security Inc., called the update some "fine tuning" of an earlier update issued by Microsoft. Microsoft bulletin MS08-068 addressed Windows authentication protocols affecting the SMB server. The SMB mishandled the challenge/response procedure, allowing an attacker who exploits it properly to gain access to files and assign full user rights.
"It's rated critical but [Microsoft is] saying that there's a very low likelihood of exploit code being generated for it," Henry said. "The critical rating follows the legacy products but it drops to a medium with Vista and [Windows Server] 2008. The code base for [Windows Server] 2008 and Vista is showing its strength."
Henry said the update should be relatively easy to deploy, but it will require a restart. The last SMB update caused some problems for administrators who attempted to deploy a workaround. Some had printers and other devices fail, Henry said.
Eric Schultze, chief technology officer at patch management vendor Shavlik Technologies LLC, said the update should be a high priority. In a statement, Schultze said the vulnerabilities are similar to what prompted the Blaster and Sasser worms a few years ago.
"We expect to see a worm released for this in the very near future," he said. "The only pre-requisite for this attack to be successful is a connection from the attacker to the victim over the NetBIOS (File and Printer Sharing) ports (TCP 139 or 445). By default, most computers have these ports turned on."
As a workaround, users can block TCP ports 139 and 445 at the firewall, although blocking those ports can halt important applications or services, Microsoft said.
"Remote attackers, even without a username and password, can take advantage of this issue and execute any commands they wish on the vulnerable server," Alfred Huger, vice president of Symantec Security Response wrote in an email message.
In Microsoft's MS09-001 bulletin, it said the flaws could be exploited remotely and rated it as critical for Microsoft Windows 2000, Windows XP, and Windows Server 2003, and moderate for all supported editions of Windows Vista and Windows Server 2008.
In December, Microsoft issued eight security bulletins, including six rated critical, addressing serious flaws in Internet Explorer and Microsoft Office that could be remotely exploited by an attacker to gain access to critical flaws and take control of a computer.
The software giant also released an out-of-band patch on Dec. 17, repairing a dangerous flaw in Internet Explorer that was being actively exploited in the wild.
|
|
|
|
