August 19th, 2009

Microsoft WINS vulnerability under attack

Posted by Ryan Naraine @ 12:09 pm

Categories: Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Data theft, Exploit code, Locally Running Web Servers, Malware, Microsoft, Passwords, Patch Watch, Pen testing, Responsible disclosure, Spyware and Adware, Viruses and Worms, Vulnerability research

Tags: Vulnerability, WINS, Microsoft Corp., Attack, Security, Ryan Naraine

Just one week after Microsoft issued a fix for a worm hole in the Windows Internet Name Service (WINS), malicious hackers have started launching attacks against unpatched systems.

The attacks, first spotted by the SANS Internet Storm Center, are hitting Microsoft Windows users who have not yet applied the MS09-039 update.

[ SEE: Microsoft: Exploits likely for 'critical' Windows vulnerabilities ]

The MS09-039 update, released earlier this month on Patch Tuesday, is rated “critical” and Microsoft warned at the time that it expected to see dangerous exploit code within 30 days.

According to SANS ISC (see chart), there has been a sharp spike in Internet activity associated with TCP Port 42 in recent days.   The vulnerability in question allows remote code execution attacks via specially crafted WINS replication packet to an affected system running the WINS service.

According to the IDG News Service, the attacks are originating from IP addresses in China.