Microsoft confirms it missed Stuxnet print spooler 'zero-day'
Researcher published info, exploit on print spooler vulnerability in April 2009
Computerworld - Contrary to reports, a bug that Microsoft patched last week had been publicly discussed a year and a half ago, security researchers said this week.
Microsoft confirmed Wednesday that it overlooked the vulnerability when it was revealed last year.
The vulnerability in Windows Print Spooler service was one of four exploited by Stuxnet, a worm that some have suggested was crafted to sabotage an Iranian nuclear reactor.
Last week, researchers at both Kaspersky Lab and Symantec, the firms that had reported the bug to Microsoft in July and August, respectively, said the print spooler vulnerability had not been publicly disclosed before they found Stuxnet was using the flaw.
Stuxnet raised the eyebrows of security experts for a variety of reasons, including its use of four different unknown, unpatched Windows vulnerabilities. Such bugs are often labeled "zero-days" because attackers exploit them before the relevant developer knows of the flaw.
It turns out that one of the four -- the vulnerability Microsoft patched last week with its MS10-061 update -- was technically not a zero-day, said Liam O Murchu, manager of operations with Symantec's security response team.
According to O Murchu, the print spooler flaw was first revealed in a security publication's 2009 issue. He did not name the magazine. On Wednesday, a Symantec spokesman declined to identify the publication, saying the article "has the source code needed to carry out the attack, info which is not publicly known yet."
But the cat is already out of the bag.
In that issue, a researcher named Carsten Kohler spelled out how to abuse the print spooler service to hijack Windows PCs and even included source code for a working exploit.
An exploit for the MS10-061 bug has also been added to the open-source Metasploit penetration testing framework by researcher Joshua Drake, who posted his attack code last Friday.
In an updated blog post, Symantec's O Murchu said Microsoft had told him that the Sept. 15 MS10-061 update patched the flaw that Kohler had exploited in his write-up.
Microsoft confirmed that today.
"Microsoft is aware of claims that the print spooler vulnerability in MS10-061 was partially discussed in a publication in April 2009," said company spokesman Dave Forstrom in an e-mail Wednesday. "These claims are accurate. Microsoft was not directly made aware of this vulnerability nor its publication at the time of release."
Forstrom went on to say that the bug was independently "re-discovered during the investigation of the Stuxnet malware" by Kaspersky Lab and Symantec.
The security firms also notified Microsoft of two other unpatched bugs that the Stuxnet worm exploited. Those flaws, which can be used by attackers to upgrade access privileges on compromised PCs to administrator status, will be patched in a future update, Microsoft said last week. It has not set a timetable for the fixes, however.
Little information is available about the two lesser vulnerabilities. Danish bug tracker Secunia, for example, has posted only bare-bones advisories, noting that one affects Windows XP while the other affects Vista and Windows Server 2008 machines.
Users can protect their computers against the print spooler exploits by downloading and installing MS10-061 via the Microsoft Update and Windows Update services, or through Windows Server Update Services.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Neustar 2014 DDoS Attacks and Impact Report For the third consecutive year, Neustar surveyed hundreds of companies on distributed denial of service (DDoS) attacks. The survey reveals evidence that the...
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts