Microsoft confirms first Windows 7 zero-day bug
Urges users to block ports until a patch is ready, but workaround cripples services
Computerworld - Editor's note: This story has been updated with corrected information about the ports Microsoft says should be blocked and the services that would be affected.
Microsoft late on Friday confirmed that an unpatched vulnerability exists in Windows 7, but downplayed the problem, saying most users would be protected from attack by blocking two ports on their firewall.
In a security advisory, Microsoft acknowledged that a bug in SMB (Server Message Block), a Microsoft-made network file and print-sharing protocol, could be used by attackers to cripple Windows 7 and Windows Server 2008 R2 machines.
The zero-day vulnerability was first reported by Canadian researcher Laurent Gaffie last Wednesday, when he revealed the bug and posted proof-of-concept attack code to the Full Disclosure security mailing list and his blog. According to Gaffie, exploiting the flaw crashes Windows 7 and Server 2008 R2 systems so thoroughly that the only recourse is to manually power off the computers.
At the time, Microsoft only said it was investigating Gaffie's reports.
On Friday, it took the next step and issued the advisory. "Microsoft is aware of public, detailed exploit code that would cause a system to stop functioning or become unreliable," Dave Forstrom, a spokesman for Microsoft security group, said in an e-mail. "The company is not aware of attacks to exploit the reported vulnerability at this time."
Forstrom echoed Gaffie's comments earlier in the week that while an exploit could incapacitate a PC, the vulnerability could not be used by hackers to install malicious code on a Windows 7 system.
Both SMBv1 and its successor, SMBv2, contain the bug. "Windows Vista, Windows Server 2008, Windows XP, Windows Server 2003 and Windows 2000 are not affected," assured Forstrom.
Attacks could be aimed at any browser, not just Internet Explorer (IE), Microsoft warned. After tricking users into visiting a malicious site or a previously-compromised domain, hackers could feed them specially-crafted URIs (uniform resource identifier), and then crash their PCs with malformed SMB packets.
Microsoft said it may patch the problem, but didn't spell out a timetable or commit to an out-of-cycle update before the next regularly-scheduled Patch Tuesday of Dec. 8. Instead, the company suggested users block TCP ports 139 and 445 at the firewall. Doing so, however, would disable a host of critical services, including network file-sharing and IT group policies.
Gaffie's vulnerability was the first zero-day reported and confirmed by Microsoft in Windows 7 since the new operating system went on sale Oct. 22.
- Microsoft strips some Windows 7 users of IE11 patch privileges
- Windows 7 powers more than half of all PCs
- HP sticks thumb in Microsoft's eye, discounts consumer Windows 7 PCs
- Microsoft retracts Windows 7 PC end-of-sales deadline
- Microsoft ends Windows 7 retail sales
- Microsoft promises IE11 on Windows 7
- Boutique PC seller laughs all the way to the bank on the back of Windows 7
- Microsoft starts auto-installing Windows 7 SP1 on consumer PCs Tuesday
- Microsoft warns of looming retirement for Windows 7 RTM
- Consumer Reports makes case for Windows 7 PCs
Read more about Security in Computerworld's Security Topic Center.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!