September 10, 2003 11:00 AM PDT
Windows flaws allow PC takeover
- Related Stories
-
FBI arrests MSBlast worm suspect
August 29, 2003 -
MSBlast echoes across the Net
August 15, 2003 -
Slapdash monster roams the Net
August 13, 2003 -
Hacker code could unleash Windows worm
July 25, 2003 -
Microsoft warns of critical Windows flaw
July 16, 2003
Special coverage
MSBlast echoes across the Net
Potent new Internet worm exploits
widespread Windows vulnerability.
The first two flaws are buffer overruns, which allow a hacker to take over a computer by swamping it with data.
The third is a denial-of-service flaw that affects a component known as the remote procedure call (RPC) process. The RPC process facilitates activities such as sharing files and allowing others to use a computer's printer. By sending too much data to the RPC process, an attacker can cause the system to grant full access to its resources. By using the flaws in tandem, a hacker could load unwanted programs onto computers through the buffer overrun flaws and then use the infected computers to launch a denial-of-service attack.
The MSBlast worm, also known as W32/Blaster and W32.Lovsan, exploited a similar vulnerability that allowed a group of unknown hackers to load data on computers worldwide in an attempt to knock out servers that run Microsoft's update services.
"An attacker who successfully exploited either of the buffer overrun vulnerabilities could gain complete control over a remote computer," Microsoft stated in a bulletin released Wednesday. "This would give the attacker the ability to take any action that they wanted on the system, including changing Web pages, reformatting the hard disk or adding new users to the local administrators group."
The bulletin released Wednesday, MS03-039, supersedes bulletin MS03-026, which in July first warned of the vulnerability MSBlast exploited. The vulnerability revealed Wednesday is similar in nature and in its potential for damage, but it affects the RPC function differently.
"It is a different vulnerability, but they have the same impact, and they affect the same ports," said Stephen Toulouse, security program manager at Microsoft's Security Response Center. "In terms of impact, it is the same."
Ports are standardized software addresses that allow applications to exchange data. Firewalls routinely prevent illicit access to such services from the Internet by blocking the specific port used by a computer to offer those services.
Microsoft is urging customers to apply the patch immediately. The company is also revisiting its overall security patching policy, Toulouse said. Now, patching is mostly left up to customers, a problem that has helped viruses spread.
Although the flaws were announced Wednesday, researchers at the CERT Coordination Center, a clearinghouse for information on Internet threats, said in August that they had detected the potential for a second denial-of-service flaw with the RPC process.
The actual flaw was first discovered by eEye security, NSFocus and Tenable Network Security.
Mike Cherry, an analyst for research firm Directions on Microsoft, said that although weekly disclosures of new software vulnerabilities may be hard on Microsoft's image, they represent a new attitude about security.
"It would be nice to go a couple of weeks without there being a new security bulletin," he said. "But one of the things they promised with Trustworthy Computing was to do bulletins on a regular basis and deliver better patches, and they've followed through on that...The old way was to try to ignore everything and hope security wouldn't be a problem."
CNET News.com's David Becker contributed to this report.
See more CNET content tagged:
RPC,
MSBlast worm,
bulletin,
denial of service,
Stephen Toulouse
