Microsoft confirms it missed Stuxnet print spooler 'zero-day'

Computerworld - Contrary to reports, a bug that Microsoft patched last week had been publicly discussed a year and a half ago, security researchers said this week.

Microsoft confirmed Wednesday that it overlooked the vulnerability when it was revealed last year.

The vulnerability in Windows Print Spooler service was one of four exploited by Stuxnet, a worm that some have suggested was crafted to sabotage an Iranian nuclear reactor.

Last week, researchers at both Kaspersky Lab and Symantec, the firms that had reported the bug to Microsoft in July and August, respectively, said the print spooler vulnerability had not been publicly disclosed before they found Stuxnet was using the flaw.

Stuxnet raised the eyebrows of security experts for a variety of reasons, including its use of four different unknown, unpatched Windows vulnerabilities. Such bugs are often labeled "zero-days" because attackers exploit them before the relevant developer knows of the flaw.

It turns out that one of the four -- the vulnerability Microsoft patched last week with its MS10-061 update -- was technically not a zero-day, said Liam O Murchu, manager of operations with Symantec's security response team.

According to O Murchu, the print spooler flaw was first revealed in a security publication's 2009 issue. He did not name the magazine. On Wednesday, a Symantec spokesman declined to identify the publication, saying the article "has the source code needed to carry out the attack, info which is not publicly known yet."

But the cat is already out of the bag.

Paris-based Vupen Security, however, pointed a finger at Hackin9, a Polish publication. Computerworld was easily able to locate a PDF of the 2009 issue on the Internet.

In that issue, a researcher named Carsten Kohler spelled out how to abuse the print spooler service to hijack Windows PCs and even included source code for a working exploit.

An exploit for the MS10-061 bug has also been added to the open-source Metasploit penetration testing framework by researcher Joshua Drake, who posted his attack code last Friday.

In an updated blog post, Symantec's O Murchu said Microsoft had told him that the Sept. 15 MS10-061 update patched the flaw that Kohler had exploited in his write-up.

Microsoft confirmed that today.

"Microsoft is aware of claims that the print spooler vulnerability in MS10-061 was partially discussed in a publication in April 2009," said company spokesman Dave Forstrom in an e-mail Wednesday. "These claims are accurate. Microsoft was not directly made aware of this vulnerability nor its publication at the time of release."

Forstrom went on to say that the bug was independently "re-discovered during the investigation of the Stuxnet malware" by Kaspersky Lab and Symantec.

The security firms also notified Microsoft of two other unpatched bugs that the Stuxnet worm exploited. Those flaws, which can be used by attackers to upgrade access privileges on compromised PCs to administrator status, will be patched in a future update, Microsoft said last week. It has not set a timetable for the fixes, however.

Little information is available about the two lesser vulnerabilities. Danish bug tracker Secunia, for example, has posted only bare-bones advisories, noting that one affects Windows XP while the other affects Vista and Windows Server 2008 machines.

Users can protect their computers against the print spooler exploits by downloading and installing MS10-061 via the Microsoft Update and Windows Update services, or through Windows Server Update Services.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com.

Read more about Security in Computerworld's Security Topic Center.