Slashdot Mirror
Microsoft to Issue Emergency Patch For File-Sharing Hole
An anonymous reader writes "Microsoft said late Wednesday that it plans to release a critical security update today to plug a security hole present in all supported versions of Windows. The company hasn't released any details about the patch yet, which is expected to be pushed out at 1 p.m. PT. Normally, Redmond issues security updates on Patch Tuesday, the second Tuesday of each month. The Washington Post's Security Fix blog notes that each of the three times in the past that Microsoft has departed from its patch cycle, it was to fix some really nasty vulnerability that criminals already were exploiting to break into Windows PCs."
Reader filenavigator points out an article which describes the hole as an SMB vulnerability, and says it "allows anyone to access a Windows machine remotely without any user name or password. Any machine that exposes Windows file sharing is vulnerable." Update: 10/23 17:42 GMT by T : Reader AngryDad adds a link to Microsoft's more detailed memo.
Gonna try this one out on the College Network right now. Shouldn't be using Windows if they don't want all their files deleted now should they?
As long as there are slaughterhouses, there will be battlefields.
...I don't use computers. They are too much of a security risk.
Let's hope that the renewed Samba compatibility effort by MS means that this bug will be ported over.
At least they didn't describe it as a MAC vulnerability
"No, but understanding is not required, only obedience."
Those damn FOSSies can gain access to SMB shares
Quick, patch it....
http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx
allows anyone to access a Windows machine remotely without any user name or password. Any machine that exposes Windows file sharing is vulnerable
Yet this comment in the "Can You Trust Anti-virus Rankings?" thread, where I noted that a dual boot with internet for linux and with networking disabled in Windows was better than AV was modded down. Of course, a lot of MSCEs and Microsoft employees come to slashdot, and I'm sure a few get mod points once in a while. No matter, my karma's fine.
And yes, kiddies, you DO need a firewall for ANY OS and any OS is prone to trojans. But no AV will protect you against an unknown trojan OR the vuln mentioned in TFA, and no firewall will keep out someone you explicitly let in.
<tinfoil hat>
Some might wonder if this vuln was introduced on purpose as a weapon against the Pirat Bay? You can bet that a lot of people are uninstalling Kazaa, Morpheus, and all other legit and illigit P2P apps. Getting rid of P2P is a blow against FOSS and indie music.
Free Martian Whores!
Why patch? Looks like they went a long way to achieve this already!
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
please, code it fast!!!, and make it as nasty as you can.
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type:Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service
In other words: any idiot on your network can gain admin access to any attached Windows-based system with file-sharing enabled. I'm really glad that they're releasing an emergency patch for this, because that's a pretty fucking crazy description of an exploit, especially since it affects all versions of their last 10 years of operating systems.
I need to dust of my IMB Selectric III?
Beer is proof that God loves us and wants us to be happy.
Has been windows' stink hole for the last 10 years. Lets hope that most people have learned they need to cover it up.
Why hasn't this been caught in the 3,000 previous security issues patched for Windows? It seems like kind of a biggie. In that list you linked to (thank you) it's present in all service packs for XP (the only Windows I use).
I don't have any of the affected services enabled so it doesn't affect me, but I think a lot of that stuff is on or can be easily activated by default.
Again, why did it take so long to catch this one? The tinfoil hat backdoor NSA spook theories seem almost believable.
Microsoft has had something like this occur regularly enough that I found myself already skipping to the next story without even reading the complete heading.
I still cannot understand why major corporations run Windows of any version in enterprise server farms. They've had so many warning signs, so many high security breaches, so many alarms, and they're still very "ho-hum" about it.
If you read the post slowly and actually acknowledge what it says, it's saying that ever since the incarnation of Windows elite hackers from Russia (or anywhere else) have been able to steal files on any machine with no problem. The underground top hackers have exploits that they guard with top secrecy and keep in their box of tricks when nothing else "known" is working.
Come on, seriously! No other product provider on the planet would be allowed such leniency. Microsoft never feels any repercussions of any of these incredible security holes. They don't even loose business over it! When is enough, enough????
I'm glad I am on OS X. No need to worry about the security hole of the minute compared to what goes on with the Linux and Windows boxes.
It's been years since I've tried, but doesn't SMB get dropped by some / all of the major residential carriers at this point? I know AT&T was dropping port 139 last time I tried leaving a machine wide open and exposed.
It's a nasty vulnerability and all, I'm just wondering if this could go all blaster / sasser.
There are some people that if they don't know, you can't tell 'em.
I notice on that page that the aggregate security rating is listed as 'Critical' for all versions of Windows up to Vista. All of the Vista and Server 2008 security ratings are listed as 'Important' even though they still allow for remote code execution..
Has Microsoft watered down the wording of 'Critical' to 'Important' simply to make newer versions of their OS sound like they are more secure?
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
I know f--- at all about linux security but is there something for it that works like AD. i mean, managing a user list on one linux box is pretty easy but how do you handle permissions for thousands of users on hundreds of servers?
This is my sig.
no seriously, it is!
Current IP filters on DOCSIS(cable) networks are actually outbound filters done at the modem which can be turned off if you've got an uncapped modem. I haven't seen any inbound filters on any DOCSIS networks(I've looked at Cox, Comcast, RR, and Charter) on 135/139.
www.isoHunt.com
Does this effect us behind routers on a home network?
Uncle Mantis
You know that a vulnerability is bad when Microsoft goes out of its regular patching cycle to hurry and plug the hole so quickly, instead of following their usual philosophy of saying "What are you talking about? There is no security hole in Windows!" and quietly patching it a few months later amidst a flood of inocuous driver updates.
And you Winders users - please DON'T forget to REBOOT after you apply this security patch (with no doubt extra luggage attached)!
I can see 5% of the Internet blinking on/off/on/off..... {6 hours}.... on again tonight.
The patch is critical on XP but only important on Vista - see Vista is MUCH more secure.
What d'ya say? You suggesting that marketing may impact a security decision? Them's fighting words...
Windows, it is.
---- Booth was a patriot ----
this time.... They are tired of having "Super Tuesday" associations...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Is to just turn off file and print sharing? Why don't they share that bit of info with us? Who would enable file sharing on windows anyway?
-- these are only opinions and they might not be mine.
My friends and I have known about this hole since high school. Every version of Windows with SMB has underlying, invisible, "root" accounts which cannot be removed without a great deal of diligence. These accounts have no password and give full access to the SMB share. I'm shocked that it has taken Microsoft this long to address the issue.
I find it more than a bit ironic that the /. story two down from this one is titiled "Microsoft Working For Samba Interoperability".
No, no sig. Really.
ThePromenader
Yeah, but all it takes is ONE person to run an email attachment (or exploit some other hole) and then it's on every computer on the LAN
windows file sharing has to my knowledge absolutely nothing to do with any P2P program.
True, which is why I tagged the article !p2p, but the public doesn't know that. The news media, owned by the proprietary entertainment industry, have associated "file sharing" with programs such as LimeWire, eMule, and BitTorrent.
We are sorry, due to the popularity of this event, registration is now full. Please search for another event.
figures.....
Anyone know if a PoC has been released yet?
Because on Vista you get a prompt: "Your computer is being hacked. Cancel or Allow?"
Mindless MS bashing does no good.
HERETIC! IMPOSTOR!
Please turn in your slashdot ID card at the door!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
So your previous amount of security turned out to be: NONE. Anyone could have remotely executed arbitrary code without authentication.
I wonder how much security you will have after the update?
... the bug was found on one of the interoperability fests:
...
...
... this is why fucking America is all that fucked up ... how the fuck should we ever control that fucking mob ... fuck!
Samba Guy: Hey dude, look, when I open a connection _this way_ I get strange replies. There is nothing similar in the docs
MS Interoperability Officer Sir, the protocol is just to complex. I wouldn't care. How about putting little hears into the password dialog, I don't like the asterisks, anyway.
Samba Guy: Dude, come on, I want to understand how the stuff works...
MS Interoperability Officer: Sir, hmm, must be part a proprietary, essential, internal routine framework. It's in there since ages. The software works, we make billions from it.
Samba Guy: But what does it do? Why do you need it?
MS Interoperability Officer: Don't know. The guy who coded it left the company.
Samba Guy: Can't we just call him?
MS Interoperability Officer: Don't think so. He must be cleaning his Yacht somewhere near Tanzania right now.
Samba Guy: Well dude, then let's see what's gonna happen if I keep going on...
MS Interoperability Officer: Sir, I'm bored. I don't like your black console anyway. It feels so 50ths.
MS Interoperability Officer: Sir, I'm in the position to offer you a free trial for Microsoft Visual Studio 2009 with Ribbon TM included.
Samba Guy: Look dude, I just got root on your machine.
MS Interoperability Officer: Sir, which idiot gave you my password?
Samba Guy: No password, dude. I just opened the connection, look here
Samba Guy show 4 lines of code.
MS Interoperability Officer: Sir, please hold on, I need to call my chief security officer.
MS Interoperability Officer talking on the phone (next door).
Minutes later the door is opened violently. Gates and Balmer enter the scene guarded by five NSA officers.
Gates: Sir, I'm sorry, you found one of the many backdoors we built into all versions of Microsoft Windows TM released after 1999. I suppose you will perfectly understand that all algorithms concerning that matter is our intellectual property which is protected by American Law.
NSA Officer (in monotone voice): Sir, I'll now use this Neutralizer TM device to erase your memories of the last twenty-four hours. You've never been in this building and you never knew about the federal data acquisition program.
A bright flash of light gets emitted from the little device.
Samba Guy: Shit, my eyes. What the fuck is wrong with you guys. That code is so freaking stupid. You can't be serious...
Another NSA Officer (in aggressive voice): Shut up criminal bastard!
First NSA Officer (in same monotone voice): Sir, you might have consumed a critical cumulative dose of THC during adolescence. The resulting altered brain circuity is resistant to portable neutralizer devices. I'm sorry to inform you're temporally arrested under federal law.
Samba Guy: Bull shit, you have no idea what you're talking about. Look I've got a hock running that sends every command I type on the console directly to twitter. Everybody does it, it's lot's of fun. Nothing I do is secret. I believe in sharing of ideas.
Ballmer (in rage): Motherfucking communists
Ballmer, well, throws chairs.
Gates (calling the still governing president of the United States): My president, sir, I'm sorry to inform you, due to certain circumstances, details concerning the federal data acquisition program might just have been leaked to the public.
Samba Guy: Hey dude, the story is already on digg. I think you should issue a patch before it is on slashdot.
Curtain gets drawn, applause.
Off stage voice: Thank you ladies and gentlemen. Please don't forget to visit windowsupdates.microsoft.com
Any machine that exposes Windows file sharing is vulnerable.
When will the Ubuntu patch come out?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
They are only offering the fix via the Windowsupdate procedure. There exists no fucking download where you can get just this patch and apply it.
I am prohibited from using Windows Update since it breaks a critical government law enforcement system we run, yet I am under orders to download and install this one patch immediately since the security hole poses a vulnerability on the inside of our network.
No patch for Windows 98SE?
Advertising, advertising, advertising, fix Vista.
Advertising, advertising, advertising, fix Vista.
http://movies.apple.com/movies/us/apple/getamac/apple_getamac_beancounter_20081019_480x272.mov
Sure, right after I withdraw some cash from the automatic ATM machine.
Hail Eris, full of mischief...
E pluribus sanguinem
You mean port 137, 138, 139, and now 445, right? 135, according to /etc/services, is for "epmap", which is "DCE endpoint resolution".
Hail Eris, full of mischief...
E pluribus sanguinem
Microsoft has released eight patches for applications with an insufficient number of security holes.
"Our market is the enterprise," said Microsoft security marketer Jonathan Ness. "Information technology professionals know that Windows is the greatest IT job creation scheme in history. Without Patch Tuesday, there's no reason for the experienced IT worker to spend his time hiding out in the server room watching progress bars and getting over his hangover. Also, you can't tell people a virus ate their mail, you actually have to get it back for them."
Several faintly cat-piss-smelling Linux users pointed and laughed in a nerdy bray at the news and a much larger number of annoying Mac users showed off their new model iPod Nanos.
http://rocknerd.co.uk
Usually the patch is 'hidden' between a flood of other critical security patches. I don't know if parent is trolling or flamebaiting, but deserving his Insightful mod, he did not.
... and their "making available" theory. They could soon be raking in $Trillions in statutory damages from the public.
Mod this AC up, the link is an interesting read.
I'm no coder, I didn't understand most of what the article says, but I got the gist of it:
In my opinion, hand reviewing this code and successfully finding this bug would require a great deal of skill and luck.
Our present toolset does not catch this bug.
First the good news; I think perhaps we have removed a good number of the low-hanging security vulnerabilities from many of our products, especially the newer code. The bad news is, we'll continue to have vulnerabilities because you cannot train a developer to hunt for unique bugs, and creating tools to find such bugs is also hard to do without incurring an incredible volume of false positives.
I'll be blunt; our fuzz tests did not catch this and they should have. So we are going back to our fuzzing algorithms and libraries to update them accordingly.
My opinion is Microsoft should have been taking the money they were getting from charging for tech support and put it into more testing and reviewing code.
I love how at the end of the article he turns it into an ad for Windows Vista.
I have given up....so I am just going to issue a challenge to all the people who bash Microsoft just because. If you think Microsoft sucks so bad then why don't you.... BUILD SOMETHING BETTER.
Below you will find a list of products (not every product) that Microsoft builds and supports. Your mission is to make each one. Not just code each one to work independently but make each one work with every other one.
Embedded OS
Mobile OS
Workstation OS
Server OS
Web Server
Project Server
Information Server
Database Server
Email Server
Multiple Computer Languages
Development IDE
Graphics Rendering
Word Processor
Spreadsheet
Presentation
Publishing
Multiple Database Clients
Email Client
Money Management
Web Design
Communication
Web Browser
Various PC Games
Various PC Hardware
Game Console
Various Console Games
Photo Viewing
Photo Editing
Media Player
Mapping
Encyclopedia
Movie
Once you do that, then you can complain.
I think I already have it disabled, but how does one go about making sure it is disabled?
And, no, I'm not giving you an IP to check for me :-)
http://www.cgisecurity.org/2008/10/emergency-micro.html
And they will finally kill it :-(
"In other words: any idiot on your network can gain admin access to any attached Windows-based system with file-sharing enabled" - by IceCreamGuy (904648) on Thursday October 23, @01:39PM (#25484483) Homepage
Well, for a system that is an endpoint node (say, a workstation) on a LAN/WAN (for example, a departmental one, or even larger @ work for instance)?
Sure - This might be a severe risk!
(Although I have had my colleagues TRY to even find my system on our LAN/WAN @ work, & they can't (one of them's a *NIX head & he likes wireshark for this type of thing amongst other tools) - yet, I have FULL ACCESS to all of our internet, email, + other network features - this is doable, this "effect", with a few simple registry hacks, many of which are covered in the URL link below no less)...
HOWEVER - if you're a "standalone user" (meaning single machine online on the internet, say, from your home)?
This is EASILY secured!
That's easily done, as you more-or-less noted via YOUR method (stopping/disabling File & Print sharing)
OR
By even going a step further -> Stopping the SERVER service (disable it via services.msc)...
There is also a method using a batch file to stop ALL shares (yes, even administrative $ type ones, ala:
C: /DELETE /DELETE /DELETE /DELETE /DELETE /DELETE /DELETE /DELETE /DELETE
NET SHARE C$
NET SHARE ADMIN$
NET SHARE IPC$
NET SHARE DFS$
NET SHARE COMCFG$
NET SHARE FAX$
NET SHARE NETLOGON
NET SHARE PRINT$
NET USE *
& technically?
Each/ALL/ANY of those measures SHOULD work, just fine, in mitigating this prior to applying this patch (especially if you're a standalone machine on the internet @ home, with no home LAN present)...
(Feel free to correct me if I am off/wrong here fellas... thanks!)
APK
P.S.=> I cover that & MUCH more, here:
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?s=49125ef36605621c1a4c34eb160411a9&showtopic=2662
&, yes, it works... vs. today's threats, especially - I say this, mainly because today's "security-suites" are NOT doing such a good job, vs. them, as evidenced here:
----
Top security suites fail exploit tests (COMPUTERWORLD):
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9117042&intsrc=news_ts_head [computerworld.com]
&/or
Top security suites fail exploit tests (SECUNIA):
http://secunia.com/blog/29/
----
&, the fact is? They're not that useful vs. threats coming from the REAL source of today's exploits (mostly), & that's javascript (+ iframes & bad or vulnerable plugins for webbrowsers, email programs, & even lately Adobe .pdf reader w/ javascript enabled (easily turned off) & their FLASH plugin system)... &, they're NOT doing well vs. std. viruses either, since many are "polymorphic" in nature today, or, use rootkit type technology... HEURISTICS & white/black lists of sites + apps are the way imo, vs. "signatures" based detection (which is good vs. KNOWN threats only really)... & most of them, depend on the latter (sigs work).
PLUS - Hey, anyone can go to SECUNIA.COM &/or SECURITYFOCUS.COM for example & see my statement here just plain 'bears out as truth', just by seeing how much (a good 95%) of today's threats come from those sources... that guide above, however? IS... & again, it just works! apk
Much like the last SMB exploit?
http://it.slashdot.org/article.pl?sid=08/05/29/1844246
Every network I've been on and even some of my current company's ISPs have a policy of blocking all traffic on smb/nmb ports (e.g. 137 and 139).
Those types of filters prevent anyone following a smb:// link outside their network which prevented that last exploit. Is this new exploit in the same category?
I think this default filtering is from way back in the day when remote MS Windows SMB/NMB exploits were a dime a dozen and/or network admins wanted to make sure files weren't being shared to the world.
A flaw in the code is not necessary to take over windows PCs. Back in the day [others not me] used to scan IP ranges for people with file sharing enabled out to the internet [i deny i ever did this hehe]. I must stress it's stupidly simple to inadvertently leave your windows network and shares wide open to the world. It takes someone to enable file sharing on the ICS host, enable it in the firewall on both network adapters. There are no warnings to the user that this will expose any shares to the world. [Add to that the number of blank passwords to administrator accounts out there :S]. Even today I rekon 1 in 40 windows machines on a broadband cable/adsl [and not behind a port blocking router] is vunerable in this way. Few ISPs in my area are clued up to blocking the appropriate ports it seems. All it would take is a simple pop up window if you try to enable file sharing on your internet facing network adaptor. (I wonder would this put a big dent in the botnet population?)
Personally, I don't actually care too much, everyone should have their equipment behind a decent dedicated firewall end of story. Relying on a firewall in the same OS was always going to be a less than ideal solution, let alone one by microsoft.
After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
At the border yes, but I recall sniffing direct connections to Verizon (and others) and there are usually several systems on your netblock infected with something and you will see probes from them.
The Samba guys should be happy considering that M$ is sending their best minds to help them achieve compatibility. How about if we do it the other way - send the Samba guys to Windows-world to show them how it should be done?
In the 'not credible' sense. Pure back-slapping.
http://blogs.msdn.com/sdl/archive/2008/10/22/ms08-067.aspx
"Over the last year or so I've noticed that the security vulnerabilities across Microsoft, but most noticeably in Windows have become bugs of a class I call "onesey - twosies" in other words, one-off bugs."
"The $64,000 question we ask ourselves when we issue any bulletin is "did SDL fail?" and the answer in this case is categorically "No!""
"The bad news is, we'll continue to have vulnerabilities because you cannot train a developer to hunt for unique bugs, and creating tools to find such bugs is also hard to do without incurring an incredible volume of false positives. With all that said, I will add detail about one-off bugs to our internal education; I think it's important to make people aware that even with great tools and great security-savvy engineers, there are still bugs that are very hard to find."
FAIL.
Look, if you're getting a constant FLOW of 'one-off' bugs being found by third parties -- no matter how theoretically 'hard' it is to find these bugs, and no matter how sophisticated your methods, there's something very, very wrong with your methods, BECAUSE THE BLACK HATS ARE ABLE TO DO IT SO WHY CAN'T YOU?
The chance of the black hats finding this bug turned out to be 100%.
If you scored less than that, I don't care your reasons, you lose, thanks for playing, try again.
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
Of course butter flies! Now how high and far depends on what exactly you use to launch it. ::}
I find it somewhat ironic that higher access to broadband will probably reduce the number of users who will be exploited vs the Blaster virus.
Sitting behind a NAT or other firewall because your machine is not direct dialing and ISP and getting a public IP will probably mean that an attacker won't be able to directly exploit this.
Read that on /. Re-posting to share.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
There are still millions of systems where Windows Update has broken and won't receive any patches and the "muppets" can't being to understand that if you try to explain it to them.
Does anyone know the location of a tool which exploits this way in? I want to play with it on my private LAN while learning about security and so forth. It's my machine, I can do anything I want to it, including use an 'exploit', right?
Reply anonymously with a link.
Who thinks this is the last hole in this particular service Microsoft will have to issue an emergency patch for? Anybody? Anybody at all?
I think it's 50/50 whether the patch itself ads a new vulnerability. Will we never learn?
BTW, there are still remotely exploitable full control vulnerabilities in a fully patched Windows machine, even before you install any apps. There always will be. Windows: it's not for networking (tm).
Help stamp out iliturcy.
"Botnets, spammers botnets!
What kind of boxes make up botnets?"
Compaq, HP, Dell and Sony, true.
Gateway, Packard Bell, maybe even ASUS, too!
Are boxes, found on botnets, all running Windows, FOO!"
Guaranteed! This comment 100% Anthrax free!
http://milw0rm.com/sploits/2008-ms08-067.zip
I get my jollies going to hotels with open WiFi and browsing all the Microsoft Windows machines around me. There's all kinds of interesting stuff around ...