Experts sound worm alarm for critical Windows bug
Microsoft patches Remote Desktop Protocol flaw, urges customers to apply update or workaround ASAP
Computerworld - Microsoft today released six security updates that patched seven vulnerabilities, including a critical Windows bug that hackers will certainly try to exploit with a network worm, according to researchers.
"This is a pre-authentication, remote code bug," said Andrew Storms, director of security operations at nCircle Security, referring to MS12-020, the one critical bulletin today and the update that he, other researchers and even Microsoft urged users to patch as soon as possible.
"It will allow network execution without any authentication, and has all the ingredients for a class worm," said Storms.
"I'm particular spooked by this one," said Jason Miller, manager of research and development at VMware. "Hackers want [vulnerabilities] that don't require authentication and are in a part of Windows that's widely used. I guarantee that attackers are going to look at this closely."
MS12-020 patches a pair of bugs in Windows' Remote Desktop Protocol (RDP), a component that lets users remotely access a PC or server. RDP is frequently used by corporate help desks, off-site users and IT administrators to manage servers at company data centers and those the enterprise farms out to cloud-based service providers like Amazon and Microsoft.
The critical vulnerability, dubbed CVE-2012-0002, could be exploited by an attacker who simply sends specially-crafted data packets to a system with RDP enabled, said Microsoft.
"Absolutely, this will be very attractive to hackers," said Amol Sarwate, manager of Qualys' vulnerability research lab, echoing Storms and Miller. "It doesn't look like it's that complicated to come up with the code sequence [to trigger the bug]."
Microsoft raised all its usual flags, and more, for MS12-020, tagging it with an exploitability index rating of "1," meaning it expects reliable exploits to appear within 30 days, and ranking the update as the one to patch before all others.
In a post to the company's Security Research & Defense (SRD) blog, Suha Can and Jonathan Ness, a pair of Microsoft engineers, went even further. "[We] strongly encourage you to make a special priority of applying this particular update," said Can and Ness.
Ideally, customers will quickly apply the patch, but Microsoft also offered a temporary workaround.
The workaround, which Microsoft automated using its Fix-it support tool, adds another layer of security by requiring Network Level Authentication, or NLA, to force authentication before an RDP session begins. The Fix-it tool applies to Windows Vista, Windows 7, Server 2008 and Server 2008 R2.
Windows XP and Server 2003, however, do not support NLA; for the former, Microsoft's released an additional Fix-it tool that adds NLA support to Windows XP Service Pack 3 (SP3) desktops and laptops.
Links to the Fix-it tools can be found on the SRD blog.
Several researchers applauded Microsoft's workarounds, in large part because unlike the patch, they don't require a system reboot, which may make server administrators skittish about applying MS12-020 itself.
- The Critical Incident Response Maturity Journey As organizations rebalance their security defenses to combat today's sophisticated threats, they're recognizing that centralized incident response capabilities are key.
- Advanced Attacks Demand New Defenses Cyber-criminals wielding APTs have plenty of innovative techniques to evade network and endpoint defenses. It's scary stuff, and ignorance is definitely not bliss....
- Securing Mobility, From Device to Network At one time, the process of managing and securing mobile devices and applications was fairly straightforward. Most organizations worried about one application (email)...
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!