Exploits Circulating for Latest Windows Holes

1sockchuck writes "Exploits are already circulating for at least two (and possibly four) of the Windows security holes addressed in Microsoft's updates on Tuesday. Several working exploits have been released for a new vulnerability in Windows Plug and Play technology, which could be used to spread a worm targeting Windows 2000 machines, according to eEye security, which has released a free scanner to help network admins identify vulnerable computers."

Comments

Microsoft Induced?

[Deltaspectre]

Perhaps this vulnerability was a 'Feature' to get people to migrate away from Windows 2000?

Only two or four...

[__aaclcg7560]

At least, Microsoft is maintaining great quality control.

Is it really New?

[ellem]

I mean W2K has been around for about... uh, 5 years?

So isn't this just an old exploit that was just found?

See? Having 900,000,000,000 lines of code is a good thing.

Re:Is it really New?

[99BottlesOfBeerInMyF]

So isn't this just an old exploit that was just found?

No. This is an old vulnerability that was just published, and had new exploits written and published for it. That is not to say other exploits have not existed for this vulnerability for the last five years.

Registration form privacy information at eEye

[mikeophile]

Our website's registration forms require users to provide contact information (names and email addresses) and financial information (account or credit card numbers). Financial information that is collected is used to bill the user for products and services purchased and is only used internally by eEye. Contact information is used to confirm and ship orders, to contact the user when necessary, and to notify users when new products and services are available. Users may choose not to receive future mailings from eEye; see the Choice/Opt-Out section below. eEye Digital Security may occasionally share visitor contact information with official product resellers that adhere to a comparable privacy policy; visitor contact information is NEVER given to other third-party vendors that are not affiliated with eEye.

Why do they insist on my personal information if they aren't going to use it?

They have the ability to let me opt out of of mailing, why don't they provide an opt out for my information in the first place?

It is interesting that...

[donleyp]

The exploits came out after the announcement and not before. It begs the question, do we need to give M$ credit for pushing the patch before the exploit became common knowledge? Compare this to Cisco who tried to squash recent publicizing of their vulnerability.

Unless I'm mis-reading this...

[goldspider]

...Microsoft patched the holes BEFORE the exploits started circulating?

If that's the case, what's the problem?

Re:Unless I'm mis-reading this...

[Espectr0]

Simple. It is known that exploits are made after MS releases the patch, by reverse engineering them. Since 90% of the people is stupid and don't patch their systems (i made this up) then these people get hit.

My rant is not against MS. It's against people (supposedly people with knowledge) don't take the time to update their systems. SP2 actually improved this by trying to push the updates in the user's throats.

Scanner?

[Fear the Clam]

"...eEye security, which has released a free scanner to help network admins identify vulnerable computers.

What, the Windows startup screen wasn't sufficient to identify vulnerable computers?

steps ahead

[fihzy]

Once again: (original at http://slashdot.org/comments.pl?sid=71367&cid=6457 101)

10) find big remote vulnerability in product
20) perfect the exploit
30) have fun with it for months
40) find another big hole in same product
50) perfect exploit for hole
60) alert vendor about original hole
70) have fun with new hole
80) goto 40