Slashdot Mirror
Microsoft Identifies, Patches Another Critical RPC Hole
Dynamoo writes "Microsoft have another critical vulnerability in the Windows NT/2000/XP/2003 line of OSes, allowing a remote attacker to run arbitrary code. In other words, this probably carries about the same risk as the well-documented RPC hole exploited by MSBlaster and Nachi. A Knowledgebase article is also available.
Given the experience of the RPC exploit, this probably gives administrators a couple of weeks to patch all the systems in their organisations. Again. Shucks, we haven't even finished patching the RPC flaw yet." You might want to keep your laptop's batteries charged; this NewsForge article suggests that the Blaster worm may have played a role in the August 14th blackout affecting the eastern U.S.
Update: 09/10 20:41 GMT by T : Reader AcquaCow suggests that administrators with multiple machines to patch visit Microsoft's Software Update Services (whitepaper), a tool for "managing and distributing critical Windows patches."
MS update downloaded the patch and it's already installed. It seems to me that hardly anyone is hearing about these bugs nowadays until after MS updates Windows. The lesson here (other than the obvious and silly "Don't use Windows") is to run MS update.
144l. ph34r my 133t l3g4l 5k1lz!
there is no excuse for anyone having RPC holes like ports 135-139 available on the internet. stupidity.
Shucks, you only had a whole fucking month to do it before the exploit made it to the wild.
You might want to keep your laptop's batteries charged; this NewsForge article suggests that the Blaster worm may have played a role in the August 14th blackout affecting the eastern U.S
The always insightful Slashdot editorial byline. RTFA - the article (On NewsForge, no less, and framed with three Microsoft ads) says the worm crashed a Unix server. Score one for reliability of "real" operating systems - and unbiased reporting.
And we weren't hit because they had the current patches and virus defs, plus they were behind a firewall. For the average Windows user, mandatory updates (OS and antivirus), and firewall defaulted to enabled should be the norm, so long as "power users" can disable this option. And services that are useless for the average user (such as DCOM) should be disabled. Those who want it can enable it, it's not that difficult!
Sent from my iPhone
It seems like many of the recent vulnerabilities have one common feature--they all use a static port.
The buggy Netgear routers that were DDoS-ing U-Wisconsin all sent the packets from one port, and the temporary solution of blocking that traffic was an easy fix (if not optimal in bandwidth terms). RPC by its very nature also uses a fixed series of ports, and Microsoft's continued ineptitude in properly programming the protocol suggests that it's time to start blocking those ports on Internet-facing computers and (for some universities or corporations where it wouldn't kill important processes) inside the firewall.
Blocking ports is probably even faster than patching thousands of computers (or convincing end users to do it! eek!); there's not much of an excuse remaining for many administrators in this regard.
We recently had heard in the office over one of the Yellow Machine that's made by Anthology Solutions.
Color me (-1, Troll), but what are the chances that the public will know or care about this? Most of my clients/coworkers/friends/family members are "just average users" who use Word, IE and Outlook, and who barely even know what a computer virus is. They certainly don't know what a "bug" or "vulnerability" is, and their grasp of computer security generally ranges from tenuous down to completely nonexistant. (My mother used to think that running a LAN in our home was "illegal", since every time her computer said "Application X has performed an illegal operation", she freaked out and asked if the cops were on their way!) Until this sort of thing ends up on the 6:00 news, as well as the front pages of USA Today and the New York Times, most people will not be aware that there is a problem. And when something happens, they will blame themselves, their kids for "messing with the computer", the last tech who touched their machine... or perhaps simply say "the computer's broken... durned computer..."
We need bugs like this to be publicized in major newspapers, the way "human" virus outbreaks (and potential outbreaks) like SARS or Ebola are. That way, people might actually start patching their systems...
Honey, I shrunk the Cygwin
Wouldn't it be easier to just turn the RPC service off or remove it? Oh, that's right. You can't do either. It's an important Windows component that helps my non-networked, non-server, non-client Win2K development laptop running correctly. If it weren't there... well it just wouldn't be there and that's not good. Thank you MS for yet another non-uninstallable, non-disableable useless service for me to worry about. I can't wait until my web browser and messageing client are at this level of necessity. Then I'll really be enpowered to run my computer the way I see fit.
US Democracy:The best person for the job (among These pre-selected choices...)
Seems impressive that such a severe exploit has been in popular operating systems for many years - when was NT 4 released? 97? - yet never taken advantage of until... well, shortly. As much as I hate to admit it, seems to prove the point that proprietary code is more secure. If people don't know a flaw exists they don't exploit it.
If linux had 90+% of the desktop how long would it take for its remote exploits to be taken advantage of?
The real threat in these situations is someone walking *past* the firewall with their laptop that they've used unprotected on the public internet, gotten infected, and then brought into the office. I've seen this happen, and then containment starts to become a nightmare.
Patching is difficult too.. if you don't have software to push the updates, you have to visit. Users aren't always on the same site, or even the same country. And although you might be able to cover 90% of your kit in the time before the worm hits, you still might have enough vulnerable PCs to take down the network.
Don't forget that patches are often unstable, and shouldn't be applied without some sort of testing and backout plan for critical systems.
So yes, this all takes a time, and the problem is the balance between the risk of rolling it out too quickly (without testing), and the risk of rolling it out too slowly. The risk of not rolling it out at all though is too great, 'cus it's just going to take that one user who wants to use their own ISP at home and you can kiss you backside goodbye.
Never email donotemail@WeAreSpammers.com
That's no fun! Then you can't spread the virus. It's like ebola, it's too destructive for its own good at killing people so that there is no one left to infect.
In other words, unless the destructive virus infects a specific number of hosts and/or expires after a sufficiently lengthy period, it would probably only impact relatively few systems.
Wrong, the flaw is in the methodology of development and testing. Unchecked buffers aren't hard to eliminate. Tools like Purify will find 90% of them automatically, a good code review will find most of the rest. Look at FreeBSD, only one remote exploit in how many years??? It CAN be done, MS just doesn't have the will, because they certainly have the resources.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Did the recent microsoft underwritten study on tco for windows and linux include the odd virus infestation and weekly patching requirements for windows machines.
And bash MS but when you have 90% of the market for desktops, of course all flaws will appear blown out in proportions. Imagine having almost everyone drive Ford cars. Then the recall rate for Fords will increase. Of course it will, it's called proportions.
Sure their coding isn't flawless, far from it, but they really are doing their best. It doesn't serve them or their customers to "make" these holes.
Trolls dont like to be Flamebait, because they burn so well. Protect our Troll heritage!
Care to explain a reason WHY? How many linux worms have there been? And of the very very few, they were all targeted at Apache (which is not part of the OS), and if we include IIS in the windows category (which has a HELL of a lot LESS market share then apache) then any comparision will yield a result very bad for Microsoft. Not to mention that many Bug counts for Linux are agregate numbers (and not distro-specific) so the numbers are multipied several times.
This also does not include the fact that Windows is very often a single-vendor solution. Windows (WS & Server), Exchange, Office, IE, IIS, etc. This amounts to a very homogenous environment, because there isn't another easy way to use Exchange with something else for the most part, or Outlook with a different server (I know projects that can (Evolution & Suse's open exchange (title?)) however, you have to be looking for an alternative. On Linux how many people use kmail, evolution, mutt, pine, webmail-type, etc etc? OpenOffice is pretty much a standard but even then we have Abiword, KOffice, LaTEX, etc etc, and afaik there is no OpenOffice email client. Desktop environments in general: CDE, GNOME, KDE, and a host of small projects. Not to mention UNIX systems (and linux systems) have a variety: RedHat Linux, Sun Solaris, IBM AIX, FreeBSD, Suse Linux, Compaq Tru64, etc. And processor arch: x86 (the majority), ppc, alpha, sparc, sparc64, mips, arm, ia-64, etc
Linux/UNIX are not vulnerable to many of the same exploits as each other. How many .0x% of linux users got hit by an exploit in apache?
Send me a virus: I will read it on an alpha in kmail, or on a sparc via mutt, etc. A worm/virus may hit a tiny percent of linux users, but how many have a setup compatible enough with the worm to actually get hit.
It's called diversity, and you might want to look at biological models. The next windows worm that tells a computer to format it's hd if it's before a patch from microsoft may mean that a heck of a lot of windows computers die. Say a virus that has a timer of a day (give it time to replicate) then kills the host? Only those who have good firewalls won't die, which is, unfortunately, not the case with windows (as seen by the recent rpc bugs.) Black ICE for example doesn't block messenger by default, does it block anything else?
A killer virus/worm could cripple most windows users, but would only kill a small percentage of linux users, unless the author very creative, and new a whole bunch of security holes in many different programs.
Diversity. Diversity. Diversity.
Unfortunately, you can only vote "Fair" or "Unfair". Sometimes a mod is so unfair that it's hilarious. Those should be lauded. Normally, the moderators are just stupid.
Yes, that means you, you stupid git. No, don't touch that button. Get away from there! *Aieeeeee*
Browse at -1 to read this comment.
...Microsoft Update downloaded and installed the patch for me already. And no, I didn't do a weeks worth of regression testing.
Now has anybody actually made a study of how much was lost, and what statistically would be the amount you can expect to lose if you deploy M$ systems? Something like a 5% chance of losing 20 million bucks, etc.? Was just thinking this should be included in any TCO studies M$ is funding.