Attack Code Found For Recent Windows Bug

CWmike writes "Just a day after downplaying the vulnerability that caused it to issue an out-of-cycle patch last week, Microsoft warned customers late yesterday that exploit code had gone public and was being used in additional attacks. 'We've identified the public availability of exploit code that now shows code execution for the vulnerability addressed by MS08-067,' said Mike Reavey, operations manager of Microsoft's Security Response Center, in a post to the MSRC blog. 'This exploit code has been shown to result in remote code execution on Windows Server 2003, Windows XP, and Windows 2000.'"

Comments

Clarification

[Raconteur]

Just in case the /. entry seemed as ambiguous to you as it did to me, the linked article states "Our investigation has shown that it does not affect customers who have installed the update."

Re:Another out-of-cycle patch is coming, right?

[TubeSteak]

No, this is the same exploit we talked about before.
If you patched on the 23rd, you should be fine.

Microsoft didn't downplay this

[Anonymous Coward]

Instead they issued an out-of-cycle patch and they gave it a very high severity rating in their bulletins. None of us are Microsoft lovers. But you don't have to lie to us just to be able to pat us on the back. It's disgusting, please stop it.

Metasploit

[slimjim8094]

Be warned; this is already on metasploit. The intrepid can find this for themselves...

Testing it to see if it actually works though.

Re:But not everyone has installed the update.

[DigiShaman]

Sure. You don't have a test network to at least smoke patches on or you would've said something

A fifteen user network all running off a cable modem, router/firewall, and Windows 2003 SBS. Sure, let me pitch the sale for them to purchase another SBS box (for testing purposes only) and the billable time required for each test required per monthly patch cycle...

What happens when your SBS box barfs

Rebuild it, add PCs back to the domain, and restore user data and exchange data. I've done it before and it's a lot cheaper alternative to the one above. Funny isn't? Sometimes it's cheaper to let a server crash and burn than spend money on preventive maintenance. It's all in how much the customer wants to spend.