Last RPC patch does not protect systems, say researchers
Security experts are warning of a flaw that could allow hackers to launch a denial of service (DoS) attack against PCs running Windows 2000 and XP. The vulnerability, in the Microsoft Remote Procedure Call (RPC) service, was discovered by security firm Internet Security Systems (ISS).
ISS warned that the flaw affects PCs even with the most current Windows patches installed, including computers patched against the devastating RPC flaw described in Microsoft Security Bulletin MS03-039 According to ISS, the DoS vulnerability exists by exploiting the race condition, allowing attackers to crash the Microsoft RPC service and/or force vulnerable systems to reboot.
News source: vnunet.com
Security experts are warning of a flaw that could allow hackers to launch a denial of service (DoS) attack against PCs running Windows 2000 and XP. The vulnerability, in the Microsoft Remote Procedure Call (RPC) service, was discovered by security firm Internet Security Systems (ISS).
ISS warned that the flaw affects PCs even with the most current Windows patches installed, including computers patched against the devastating RPC flaw described in Microsoft Security Bulletin MS03-039 According to ISS, the DoS vulnerability exists by exploiting the race condition, allowing attackers to crash the Microsoft RPC service and/or force vulnerable systems to reboot.
News source: vnunet.com
But the firm added that "significant barriers exist" which may prevent reliable exploitation outside controlled lab conditions.
ISS said that Microsoft has not yet released a patch for the vulnerability, and urged network administrators to assess external exposure to vulnerabilities associated with Microsoft services running on ports 135, 137, 138, 139, 445 and 593 on both the network perimeter and VPN connections.
Speaking at Microsoft's Partner Summit in New Orleans last week, chief executive Steve Ballmer criticised security researchers and their methods of disclosing vulnerabilities early.
"These are people who discover vulnerabilities, and it's part of their job to go public with them," he said.
"What we have done over the last six months is intersect with them to make sure disclosure is done in a more responsible way. I wish these people would just be quiet, but that's not going to happen."
ISS countered that it had speeded up disclosure of the vulnerability because tools are in circulation to demonstrate the DoS condition.
He is talking about the patch for the Blaster virus. It was released almost 3 weeks before the virus was released, and Microsoft went out of their way to get the news out. I got a email from them on a email address that I had no idea that they had (kind of scary). They are also STILL releasing patches for Windows NT4, which they don’t HAVE to do, since support was discontinued in June for the OS.
I get tired of all the people that bash Microsoft. If it wasn’t about these patches, it would be about something else. If you don’t like their products…. Get Linux. “They are the worst software company out there, but they are better then the rest”
I'm currently getting a load of these e-mails from numerous addresses at "charter.net" and I'm sick of them. Not entirely sure how people know my private home e-mail address, must be a friend of mine who has it in their address book and it virus-ridden. *sigh*
you'll have to check DAILY the Windows Update page
Keeps getting annoying, to be quite honest with ya.
Why doesn't MS makes programs/OS's that work! That's what they're hired for, right?
The programs that MS work fine... I'd like to see security over eyecandy, but as long as they're script kiddies out there, you're going to have to be vigilant about patching yer system...
is always the same bullsh*t. If you dont like it so much just go to Linux or get a Mac or something. I've had windows for quiet sometime and i've never been affected by one of these vulnurabilties, neither have other two computers running XPHE and win2k. I've always kept up to date with these things, and have never had a problem, and if i do have a problem then oh well, i'l just try my best and fix it. You people somethng better to do than just sit there and complain, i bet some of you didn't even pay for the OS your using and are still complaining about it.
Just a weak shot of humor for the thread
just making a remark. and that's different.
i also have not been affected anyhow from ms vulnerabilities. however, like i said, it's getting on my nerves to daily visit the windows update site.
that's all.
Auto update is fine for home PC's . On a network not a chance in hell.
That is why TheDeputy has a valid grumble . This is is costing a lot time and money .
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.