ZDNet UK / News and Analysis / Security / Security Management

Microsoft plugs 'enormous' hole

By Staff, CNET News, 17 July, 2003 07:34

Daily Newsletters

Sign up to ZDNet UK's daily newsletter.

Topics

Flaw, Microsoft, Windows, Update, polish hackers, Security, Patch

NEWS
Windows users should expect to have another update from Microsoft waiting for them on their computers. The software giant issued a patch on Wednesday morning to plug a critical security hole that could allow an attacker to take control of computers running any version of Windows except for Windows ME. A group of Polish hackers and independent security consultants, known as the Last Stage of Delirium, discovered the flaw and worked with Microsoft to fix it. "It should be emphasised that this vulnerability poses an enormous threat, and appropriate patches provided by Microsoft should be immediately applied," the group said in an advisory posted to its Web site. The group said that programs designed to exploit the vulnerability will probably be available on the Internet soon. The flaw is in a component of the operating system that allows other computers to request the Windows system perform an action or service. The component, known as the remote procedure call (RPC) process, facilitates such activities such as sharing files and allowing others to use the computer's printer. By sending too much data to the RPC process, an attacker can cause the system to grant full access to the system. "This would give the attacker the ability to take any action on the server that they want," Microsoft stated in its advisory. "For example, an attacker could change Web pages, reformat the hard disk, or add new users to the local administrators group." Jeff Jones, senior director for Microsoft's Trustworthy Computing effort, said that, in addition to applying the patch, users and systems administrator should close down any unused communications channels, or ports. "Customers should protect their network with a firewall," he said. "Individual users should use the Internet Connection Firewall or some other personal firewall." The Internet Connection Firewall is a feature of Windows XP and Windows 2003 that limits the ways that a potential intruder could attack from the network. Ports are standardised software addresses that allow applications to exchange data. Firewalls routinely prevent access to such services from the Internet by blocking the specific port used by a computer to offer those services. Internet Security Systems, a network protection company based in Atlanta, warned its customers of the flaw on Wednesday. The company said in an advisory that it had raised its measure of the danger posed by threats on the Internet because of the vulnerability's seriousness. Microsoft is well into the second year of its Trustworthy Computing initiative. Aimed at boosting customers' trust in the company's products, the initiative has been both praised as a bold move to become a leader in security and criticised as largely ineffectual. Jones says the company is learning from its mistakes. In this case, Microsoft analysed where the flaw crept in, and it developed plans to build in the expertise to detect it in the company's in-house development tools. "It was primarily a process issue," he said. "We will be updating our automated scanning tool to make sure this type of issue is detected in the future."
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Let the editors know what you think in the Mailroom.

Related stories

Microsoft patches 'important' security hole

Microsoft patches 'critical' holes

Windows 2000 SP4 arrives - but may need patching

NHS patients' health data to be anonymised and shared

Apple releases Flashback tool for Mac OS X 10.5

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Jack Schofield

@openhgs Windows users have had multiple desktops since Linus started writing Linux. They just haven't shipped as standard because not enough...

2 hours ago by Jack Schofield on Windows 8 could speed multi-monitor uptake
Jack Schofield

@Phil at Cloud4 What, Microsoft gets £1,200 per PC and £1,622 per server? Gosh, I'm amazed....

2 hours ago by Jack Schofield on 6 million wasted licences and £1,200 PCs: welcome to government IT
craigsc

You guys have no idea what is going on at Autonomy. Autonomy could have been a much more profitable organization. The sales operations at Autonomy...

4 hours ago by craigsc on HP cuts 27,000 staff as Autonomy chief Lynch leaves
Moley

How does this impact on dual or multi booting? Seems to me to more or less prohibit this, from Windows 8 anyway. Will Grub 2 recognise Windows 8,...

4 hours ago by Moley on Windows 8 start-up speed forces USB boot workaround
apexwm

I don't understand why there cannot be a slight pause during the boot process so the user can press a key. Many operating systems do this, even if...

5 hours ago by apexwm on Windows 8 start-up speed forces USB boot workaround
Gavin Goodman

You can now buy the Xi3 modular computer in the UK at http://www.ocdistribution.com . This can be bought with the Tand3m software, pricing and...

6 hours ago by Gavin Goodman on CES 2012: Xi3 microSERV3R
Phil at Cloud4

I agree: Mike Lynch can clearly build a business and manage strategy. I suspect the exit of Mike is more likely the end of a planned handover...

9 hours ago by Phil at Cloud4 on HP cuts 27,000 staff as Autonomy chief Lynch leaves
Phil at Cloud4

This is unbeleivable government wastage with only one winner... Microsoft 1 - Tax payer Nil!

9 hours ago by Phil at Cloud4 on 6 million wasted licences and £1,200 PCs: welcome to government IT
Mispam

So what do you do when you can't boot into windows? Why can't I just hold Shift while I power up instead of having to boot into windows and click a...

10 hours ago by Mispam on Windows 8 start-up speed forces USB boot workaround
apexwm

I've also seen that Mac OS X for Intel machines is supposed to run in VirtualBox, which would also be a nice solution. I've never tried it though.

12 hours ago by apexwm on xTreme Triple Booting: Linux, Mac & Windows
dave heasman

What I wonder is why when companies are caught bang to rights in not providing contracted services, people bend over to smear the customers? Surely...

12 hours ago by dave heasman on Virgin throttles broadband for high-speed customers
pjc158

Strange statement from HP regarding Mike Lynch and not capable of scaling a company. Autonomy was a $7bn purchase which started as a small company...

13 hours ago by pjc158 on HP cuts 27,000 staff as Autonomy chief Lynch leaves
lojolondon

Or - possibly, they will destroy business by ensuring people do not invest where there is no return. Another socialist idea, well beyond it's...

15 hours ago by lojolondon on Open Data Institute will act as biz incubator
J.A. Watson

Good stuff Jake, very interesting. Thanks. jw

16 hours ago by J.A. Watson on xTreme Triple Booting: Linux, Mac & Windows
openhgs

"the cost of a second LCD screen is about the same as one day of an office worker's time, so this should soon be recouped in extra productivity."...

17 hours ago by openhgs on Windows 8 could speed multi-monitor uptake
Thomas Gellhaus

I also installed the KDE version; I also will probably try out razorqt since I really haven't had a chance to before. I'm looking forward to the...

1 day ago by Thomas Gellhaus via Facebook on Mageia 2 Released
francisabigail

Acquiring when reinvention/cannibalization is too challenging for a large organization can be an excellent strategy- still, so many mergers stumble...

1 day ago by francisabigail on Ariba buy parks SAP on Oracle's cloud turf
apexwm

All of the feedback regarding using a touch monitor for a desktop PC is right on. Several months ago, we installed a "demo" multitouch all-in-one...

1 day ago by apexwm on Windows 8 could speed multi-monitor uptake
191706

anyone wanting to triple boot *their* own Mac

2 days ago by 191706 on xTreme Triple Booting: Linux, Mac & Windows
SoapyTablet

Cont.. Biggest Bugbear: Win7's stop-animate-go approach to work, you develop a staggered (not in the above alchohol sense of the word) approach to...

2 days ago by SoapyTablet on Windows 8 could speed multi-monitor uptake

Latest in Security Management

NHS patients' health data to be anonymised and shared

Apple releases Flashback tool for Mac OS X 10.5

IPv6 security: What you need to know

Featured white papers

CIO challenges: Bringing your iPad to work

Aruba Networks

CIO challenges: Bringing your iPad to work

The arrival of personal technology in the office is a challenge for all organisations, but how can it be adapted securely for corporate... Read more

Eight questions about your intrusion security solution

HP

Eight questions about your intrusion security solution

Are you confused about your intrusion security systems? Separate the intrusion prevention contenders from the pretenders with these essential... Read more

How to defend mobile applications

HP

How to defend mobile applications

Your customers can now perform sensitive transactions anywhere, and mobile apps, devices and data can be more easily attacked. How can you defend against mobile... Read more

Inside ZDNet UK

Axis: Inside Yahoo's iOS-loving browser

Axis: Inside Yahoo's iOS-loving browser

Linux Mint 13 "Maya" Released

Linux Mint 13 "Maya" Released

Asus Transformer Pad TF300T

Asus Transformer Pad TF300T

How to gain total message system visibility

How to gain total message system visibility

HTC One V: First take

HTC One V: First take

SharePoint deployment: The final chapter

SharePoint deployment: The final chapter

Ten IT jobs to save up for those rare lulls

Ten IT jobs to save up for those rare lulls