Microsoft Fixes Critical Remotely Exploitable Windows Root-Level Design Bug

An anonymous reader writes "In this month's Patch Tuesday, Microsoft has released nine security bulletins to address 56 unique vulnerabilities in Microsoft Windows, Microsoft Office, Internet Explorer, and Microsoft Server software. Of the nine security bulletins, three are rated Critical in severity, and among these three is one that addresses a years-old design flaw that can be exploited remotely to grant attackers administrator-level privileges to the targeted machine or device. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights." Reader jones_supa writes, though, that the most recent patch rollout came with a bug of its own, since corrected: the company apparently botched a rollup update for Visual Studio 2010 Tools for Office Runtime: "There is an issue with KB3001652: many users are reporting that it is locking up their machines while trying to install it. It does not seem that this patch is doing any other damage though, such as bricking the operating system. These days Microsoft appears to be reacting quickly to this kind of news as it looks like the patch has already been pulled from Windows Update."

Comments

VS2010 patch locks up OS?

[jfbilodeau]

Why would a patch for an IDE lock up an OS?

Is Microsoft able in any way to create products that are not intractably entrenched in their OS?

Re:The most insecure OS in the world

[monkeyzoo]

Windows - the most insecure OS in the world.

True, but only because Adobe never made an OS.

TFA Says Patch is Fixed

[Bacon Bits]

The article says the patch has already been updated and is safe to install.

Sad Hacker

[sir-gold]

Somewhere in the world, there is a hacker crying into his keyboard right now, because MS finally found the hole he's been exploiting for the last 10 years.

Re:oh you motherf~}NO_CARRIER

[ihtoit]

whoa, 0.01% of 800 million (a very conservative estimate of the installed base) is still 80,000. That's a number far greater than 0 and most definitely of concern if you're one of those 80,000.

The XP Killer?

[bill_mcgonigle]

We've been waiting for that vulnerability that will finally create such havoc on XP that people will abandon it.

The security bulletin is vague, as usual, but it does say:

A remote code execution vulnerability exists in how Group Policy receives and applies policy data when a domain-joined system connects to a domain controller. To exploit this vulnerability, an attacker would have to convince a victim with a domain-configured system to connect to an attacker-controlled network.

An attacker who successfully exploited this vulnerability could take complete control of an affected system and then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by improving how domain-configured systems connect to domain controllers prior to Group Policy accepting configuration data. ...

Although Windows Server 2003 is an affected product, Microsoft is not issuing an update for it because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems. Microsoft recommends that security-conscious customers upgrade to a later operating system in order to keep pace with the changing security threat landscape and benefit from the more robust protections that later operating systems provide.

Which would seem to put the XP/2003 lineage one malware download away from connecting to a botnet that spoke just enough Domain protocol to exploit it and being pwned.

NSA could have such an exploit ready next week, Russian mafia in a month. The Prize is controlling close to 19% of the installed base.

Re:The XP Killer?

[Dwedit]

Everyone runs Admin on XP anyway, so privilege escalation is less of a problem than it could be.

Re:The XP Killer?

[tlhIngan]

We've been waiting for that vulnerability that will finally create such havoc on XP that people will abandon it.

It only affects domain-joined PCs. If you're running XP Home (can't join a domain to begin with), then it really doesn't affect you.

It's a basic downgrade attack - similar to how those TLS bugs were done. You force the client and/or server to revert to an older less secure authentication protocol and then use that to get your way in.

And most businesses have moved off XP.

Patching is NOT ENOUGH

[jeffasselin]

One very important part of this latest vulnerability is that patching your systems is NOT ENOUGH. The patch is not so much a fix as an entirely new security functionality which must be configured properly.

It is required to configure a group policy to harden your systems. Any domain-joined system must have both the patch installed and a group policy setup to force the system to use secure authentication and validation mechanism on any sensitive share. Domain shares such as NETLOGON and SYSVOL are an obvious priority, but any share used for software deployment or script execution must be similarly listed.

Make sure you read the KB article and take the proper steps to secure your systems:

https://support.microsoft.com/...

Re:The most insecure OS in the world

[Archangel Michael]

True. But Adobe already creates exploits for all the other OSes in the world, so they don't need to actually create an unsecured OS.

Re:oh you motherf~}NO_CARRIER

[WasteOfAmmo]

After some investigation it looks like the update may not have been configured to do a silent install properly and actually hangs as it is waiting for user input on an invisible dialogue box.

If you have a machine that does hang we have found the following:
1. wait until there is virtually no disk activity (counting on you have a light that shows you) and then power the machine down, or
2. use either PowerShell remoting or psexec to kill the two processes involved in the update: "Setup" and "vstor_redist".
With PowerShell: Invoke-Command -ComputerName hostname -ScriptBlock {Stop-Process -Name Setup,vstor_redist -Force}
With PSExec something like this will work:
Psexec \\hostname cmd
Taskkill /im Setup /f
Taskkill /im vstor_redist /f
Exit

If the machine is doing a number of updates killing the two processes above will allow the machine to continue with the rest of the updates.

Of course the standard disclaimers apply: No guarantees the above will help and not harm you computer, your mileage may vary, batteries not included, objects in code are buggier than they appear, yadda, yadda.