Microsoft Confirms Zero-Day Hours After Exploit

CWmike writes "Microsoft confirmed on Tuesday an unpatched vulnerability in Windows just hours after a hacking toolkit published an exploit for the bug. A patch is under construction, but Microsoft does not plan to issue an emergency update to fix the flaw. The bug was first discussed Dec. 15 at a South Korean security conference, but got more attention Tuesday when the open-source Metasploit penetration tool posted an exploit module crafted by researcher Joshua Drake. Metasploit says successful attacks are capable of compromising victimized PCs, then introducing malware to the machines to pillage them for information or enlist them in a criminal botnet."

Comments

Would it kill you to link to the Microsoft article

[BBTaeKwonDo]

http://www.microsoft.com/technet/security/advisory/2490606.mspx

Re:Bashfest

[Microlith]

Oh wait, this is a NEW bug. Not the one noted above. Silly me.

Re:Bashfest

[BBTaeKwonDo]

That's a different exploit. The new one at http://www.microsoft.com/technet/security/advisory/2490606.mspx affects the graphics rendering engine, the one you linked to http://www.microsoft.com/technet/security/advisory/2488013.mspx refers to CSS.

Re:Bashfest

[Monkeedude1212]

If the maintainer of the tool is to be believed, MS has known of this flaw for almost six months and done nothing

In all fairness, bugreport@microsoft.com is just an Exchange mailbox that forwards to gates@microsoft.com, which Bill lost the password to years ago and simply started up bgates@microsoft.com, and forwarded the old address to the new one, and then because his wife was a little untrustworthy she secretly went into Active Directory one day and created an account, Jay Smith, and forwarded Bills new account to jsmith@micrsoft.com and she checks that every other week or so, and of course Bill is no longer really with Microsoft, just a shareholder, so whenever she comes across a bug report she forwards it now to the new actual address, support@microsoft.com, which is actually a mailbox that no one checks regulary but they have an application designed to take in new emails and generate work tickets based on the requests, though it only does the generating of emails once a day. Then of course the IT Manager gets hundreds of these unassigned tickets a day, and he has to sift through them and designate them to the proper Microsoft Technicians who will then fix the bug, however the subject field in the application was only a few characters long and all the Manager could see was "FWD:FWD:FWD:FWD:..." and thought it was another chain message, so he put it in the junk folder.

So really - while I believe the maintainer of the tool probably did try to inform MS of the flaw - I think he might have chosen the wrong email address.

Re:Would it kill you to link to the Microsoft arti

[__aaqvdr516]

I'm too lazy to click the link. What about us under Win98?

Non-Affected Software

[BasharTeg]

Non-Affected Software
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems

Re:Non-Affected Software

[Red Flayer]

So Windows doesn't give a flying fuck about any OS that's already EOLed or it's EOLing soon?

Who woulda thunk it?

Re:Non-Affected Software

[Red Flayer]

My point was that MS hasn't bothered to hotfix it because it doesn't affect their latest-gen OSes... even though some of the OSes it DOES affect are not yet EOLed.

Did you miss the part about this affecting OSes that are't yet EOLed (but will be in the next year or so)?

Re:Non-Affected Software

[onionman]

Non-Affected Software...
Windows Server 2008 R2 for Itanium-based Systems

Good thing for that guy!

Re:Non-Affected Software

[hairyfeet]

Or maybe, just maybe, it could be because the bug is in the graphics rendering subsystem which had been changed and tweaked a lot for Win 7, and is therefor unaffected. Do you have ANY idea how many apps call upon the Windows graphics subsystems? And we are also talking about WinXP here, aka "hey lets all run as admin" which means apps can REALLY hook into the graphics subsystem and when the patch tweaks that?

Don't forget that the big selling point of Windows is its backwards compatibility which means when you are gonna patch it damned well better be tested! Can you imagine the royal shitfits if everyone came to work on Wednesday after Patch Tuesday and found their PS Pro, Photoshop, Picasa, and many of the other apps that use graphics went tits up? Hell the support lines would be hit so hard it would be a miracle if the lines didn't melt.

So don't blame on malice what can easily be explained by just requiring a shitload of work. imagine YOU were tasked to fix a graphics subsystem in 10 year old code that the original designers have done skipped off to greener pastures? Where if you don't patch it just right you can break thousands of third party app s that you have NO control over but which your customers depend on? man I wouldn't want that job, no way in hell. I bet those guys have ulcers and are bald by 30 just from the stress.

Re:Bashfest

[antifoidulus]

Bashfest? I didn't think Windows shipped with the Bourne Again Shell, does this exploit install it?

*Rimshot

Re:Bashfest

[Red Flayer]

Bashfest? I didn't think Windows shipped with the Bourne Again Shell, does this exploit install it?

*Rimshot

What the hell do Blackberries have to do with this exploit? Do Blackberries even run Windows?

Re:Bashfest

[Teun]

+ insightful!

zero-day release isn't quite the same

[YesIAmAScript]

We're talking about a zero day exploit not a zero-day release.

With a zero-day exploit it means you had zero days of warning to patch the flaw before an exploit was spotted in the wild. So basically it means someone out there found this bug on their own and was using it for their own nefarious means before the good guys even knew about it the existence of the bug.

Not every exploit is a zero-day one, but for some reason they are all called zero-day exploits now.

This one doesn't seem like a zero-day exploit since the bug was found 20 days before there was any known exploit.