Microsoft's "Dead Cow" Patch Was 7 Years In the Making

narramissic writes "Back in March 2001, a hacker named Josh Buchbinder (a.k.a Sir Dystic) published code showing how an attack on a flaw in Microsoft's SMB (Server Message Block) service worked. Or maybe the flaw was first disclosed at Defcon 2000, by Veracode Chief Scientist Christien Rioux (a.k.a. Dildog). It was so long ago, memory is dim. Either way, it has taken Microsoft an unusually long time to fix. Now, a mere seven and a half years later, Microsoft has released a patch. 'I've been holding my breath since 2001 for this patch,' said Shavlik Technologies CTO Eric Schultze, in an e-mailed statement. Buchbinder's attack, called a SMB relay attack, 'showed how easy it was to take control of a remote machine without knowing the password,' he said."

Comments

Re:SMB?

[cloakable]

SMB is Server Message Block, and is the protocol used by Windows filesharing. People would use it include anyone who has shared a folder under Windows, and virtually any enterprise using an Windows AD domain.

As far as I know, there is no workaround, save perhaps installing Windows Services for Unix and using NFS.