- Related Stories
-
Microsoft releases early IE fix
February 2, 2004 -
Seeds of destruction
January 15, 2004 -
Microsoft releases monthly security fixes
October 15, 2003 -
MSBlast echoes across the Net
August 15, 2003 -
Flaws in common software threaten Net
February 12, 2002
On Tuesday, the software giant released a fix for a networking flaw that affects every computer running Windows NT, Windows 2000, Windows XP or Windows Server 2003. If left unpatched, the security hole could allow a worm to spread quickly throughout the Internet, causing an incident similar to the
Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.
This is the second time this month that Microsoft has warned users of a security flaw. The company has a new policy of announcing vulnerabilities and
Last week, the software maker revealed a security
The latest flaw exists in Microsoft's implementation of a basic networking protocol known as Abstract Syntax Notation One, or ASN.1. The code is shared by many Windows applications, and if left unpatched, it causes each program that uses the code to be an entry point into the operating system for an attacker.
Such widespread vulnerabilities are most tempting for the underground coders who create worms such as MSBlast--also known as Blaster--and Slammer, both of which took advantage of widespread Windows flaws.
The vulnerability could allow a remote user to take control of a computer running a version of the Windows operating system that hasn't been patched, according to the
"This means a high number of vulnerable systems out on the Internet," said Brian Dunphy, director of managed security services for security software company Symantec. "It's a good candidate for an Internet worm."
Special coverage
Fast-moving worm exploits a
widespread weakness in Windows.
"It is relatively similar in terms of the number of computers it could affect," he said, adding that the flaw "is in all versions of Windows."
Created by Xerox and standardized in 1984, ASN.1 is a way to describe networking data and protocols, said Bancroft Scott, president of
"Twenty years ago, people frequently reinvented the wheel when they wanted to pass data," he said in a January interview on the subject of ASN.1. "There was no standard way to describe the data that you were going to send."
ASN.1 changed that, allowing developers to describe data in an abstract language. However, developers of tools for creating network protocols and software from those descriptions frequently didn't consider that Internet attackers would use the channel as a way to break into computers, Scott said.
The widespread use of ASN.1 has led many security researchers to label it a possible "monoculture"--a population so homogeneous that a single threat could destroy it. A recent trend in the computer security world is the recognition that
eEye's Maiffret was critical of Microsoft for
"Two hundred days to fix this," Maiffret said. "It is obviously ridiculous."
Microsoft's Toulouse said the fix took so long to create because of the difficulties posed by such a pervasive technology.
"ASN.1 is really an extremely deep...technology in Windows itself," he said. "This investigation required us to evaluate several different aspects. This is an instance where we really had to do our due diligence."
See more CNET content tagged:
ASN.1,
MSBlast worm,
flaw,
vulnerability,
worm
