Microsoft released critical fixes on Patch Tuesday for vulnerabilities that could leave the door open for worms that wreak havoc on business networks. In all, Microsoft released one security bulletin that addresses three vulnerabilities, two of them rated critical.
“Both vulnerabilities rated as critical by Microsoft are server-side remote code-execution vulnerabilities in the Server Message Block (SMB) protocol,” said Alfred Huger, vice president of Symantec Security Response. “Remote attackers, even without a username and password, can take advantage of this issue and execute any commands they wish on the vulnerable server.”
How Big is the Threat?
Wolfgang Kandek, CTO of Qualys, agreed that none of the three SMB vulnerabilities require credentials or user actions for successful exploitation. In addition, he noted, SMB is installed on all Windows operating systems by default, making it a critical component.
“IT administrators should treat the bulletin with attention, as the vulnerabilities can result in a denial-of-service attack or remote code execution,” Kandek said. “The Exploitability Index for this month rates all CVEs at level three, ‘functioning exploit code unlikely,’ which is surprising to us as there have been discussions on CVE-2008-4114 regarding ways to exploit the vulnerability. Although we have not seen an active exploit in the wild, we were able to reproduce the denial-of-service condition in a lab
environment. It is interesting that Microsoft would rate it a three, as there has been knowledge shared on how to exploit it.”
Even though the SMB vulnerabilities are listed as critical, Andrew Storms, director of Security at nCircle, said nearly all users will find themselves automatically protected by default operating system and firewall configurations. “Despite these existing configuration protections, users are still urged to install this patch ASAP,” he said. “Everyone should try to start the new year out right by taking this slow MS month to ensure they have…