Zero Day

Exploit published for Windows worm hole

Posted in:

Arbitrary Code Execution
Browsers
Complex Attacks
Data theft
Exploit code
Hackers
Malware
Metasploit
Passwords
Patch Watch
Responsible disclosure
Windows Vista
Zero-day attacks

Reliable exploit code for the remote code execution vulnerability patched with Microsoft's MS08-067 update has been posted to the Internet, prompting a new "patch immediately" advisory from the Redmond software maker. The exploit, which has been added to the freely available Metasploit point-and-click attack tool, provides a roadmap for code execution on Windows 2000, Windows XP, and Windows Server 2003. A second exploit has been posted to Milw0rm.com, increasing the likelihood of in-the-wild malware attacks. [ SEE: MS ships emergency patch for Windows worm hole ] From the Microsoft advisory:

Our investigation of this exploit code has verified that it does not affect customers who have installed the updates detailed in MS08-067 on their computers. Microsoft continues to recommend that customers apply the updates to the affected products by enabling the Automatic Updates feature in Windows.

Several proof-of-concepts have also been publicly released. Microsoft shipped an out-of-band update last week to plug the hole after discovering “limited, targeted attacks" against Windows users. The attacks included the use of reconnaissance Trojans hijacking sensitive system information. The vulnerability is due to the Windows Server service not properly handling specially crafted RPC requests. The vulnerable Windows Server service provides RPC support, file and print support, and named pipe sharing over the network. It is also used to allow the sharing of your local resources (such as disks and printers) so that other users on the network can access them.

posted by Ryan Naraine
October 28, 2008 @ 1:40 pm

Previous Post: Facebook worm finds a friend in Google Reader
Next Post: Talkback Tuesday: latest MS vulnerability

Last 10 posts:

Opera patches 'extremely severe' security hole (11-23)
Exploit published for critical IE 7 zero-day flaw (11-23)
Inside the Google Chrome OS security model (11-19)
Microsoft finds security hole in Google Chrome Frame (11-19)
Mozilla locks out rogue Firefox add-ons (11-18)
Thousands of web sites compromised, redirect to scareware (11-17)
Microsoft confirms 'detailed' Windows 7 exploit (11-16)
Man-in-the-middle attacks demoed on 4 smartphones (11-13)
Microsoft bracing for malware attacks from embedded fonts (11-12)
Apple Safari exposes Windows to drive-by download attacks (11-11)