Microsoft patches long-known Windows bugs

One flaw was disclosed 22 months ago but never exploited, says company; another may be 7 or 8 years old

Microsoft Corp. today patched four vulnerabilities in two security updates for Windows and Office, including a critical bug that had been publicly disclosed nearly two years ago.

The most serious of the two updates, MS08-069, fixed three separate flaws in XML Core Services, the component that not only provides interoperability between several scripting languages -- including JScript and Visual Studio -- and XML applications, but more importantly allows Internet Explorer to render XML-based content.

"The name says it all," said Andrew Storms, director of security operations at nCircle Network Security Inc. "This is a core service for all versions of Microsoft Windows, and it will certainly be a source of research for attackers."

Other security experts agreed. "The XML Core Services vulnerability is more of a concern, because it will have more of an opportunity to be exploited," said Ben Greenbaum, a senior research manager at Symantec Corp., referring to the over-the-Internet vector that attackers could take to leverage the flaw.

"It affects most versions of Windows," echoed Amol Sarwate, manager of Qualys Inc.'s vulnerabilities research lab. "It's much more mainstream than the other, but it would require some kind of user intervention, so wormable code is not likely."

Of the three bugs patched in MS08-069, the only one named "critical" was pegged with a CVE (Common Vulnerabilities and Exposures) label in early 2007, and according to Microsoft, went public more than 22 months ago.

At that time, noted Polish security researcher Michal Zalewski, who now works for Google Inc., posted details about several Internet Explorer flaws to the Bugtraq mailing list. Zalewski also pointed out that he had first brought up the problem six months before that, when he described a flaw in Mozilla Corp.'s Firefox and said that other browsers were unlikely to be immune.

The vulnerability turned out to be not in IE itself, but in a service it relies on, XML Core Services, Greenbaum said. He and the other researchers, however, were at a loss to explain, if some information had been released in early 2007, why hackers had not exploited the bug.

But they had ideas.

"Perhaps the skill level [needed by the hacker] was high," Storms said. "There might have also been enough mitigating factors to make it difficult to exploit."

Sarwate seconded that. "According to Microsoft's Exploitability Index, it involves a race condition," he said, "which means the reliability of an exploit really depends on what other resources are available on the target. In other words, an exploit might not work on every machine."

This is the second month that Microsoft has posted estimates in its Exploitability Index of how likely it is that attack code would be generated in the next 30 days. The company pinned the Zalewski bug with its second-highest ranking: "inconsistent exploit code likely."

November's other update, MS-08-068, though rated only "important" in Microsoft's scale, has an even longer history, researchers said. Greenbaum noted that a similar bug was patched by Microsoft three years ago in MS05-011, but he also found evidence of the flaw going back to 2000.

Another researcher said he too had traced the vulnerability back years. "From what I can tell, it appears that [this] is addressing a vulnerability that was first made public 7+ years ago," said Eric Schultze, the chief technology officer at St. Paul, Minn.-based Shavlik Technologies, in an e-mail. "Sir Dystic, from Cult of the Dead Cow, found a vulnerability [and] wrote a utility called SMBRelay to demonstrate the flaw," Schultze continued. "Microsoft was aware of the issue but didn't issue any security bulletins or patches to correct the behavior."

The fix quashed a single flaw in how the Server Message Block (SMB) protocol handles credentials when a user connects to an attacker's SMB server.

Microsoft not only confirmed that the vulnerability was public knowledge before today, but it also said that exploit code was already out and about. That, and other characteristics of the bug, got the attention of Wolfgang Kandek, the chief technology officer at Qualys. "I would expect this to be exploited inside companies, on their intranets, rather than over the Internet," he said, explaining that it's easy to block attacks at the perimeter firewall. "But this could in fact be a stealthier attack," he added, noting that targeted attacks against enterprises often go unreported.

All four researchers said that this month's light patch load was noteworthy. "Pretty light, pretty easy," Storms said. "There's an upside to having a break from October and the out-of-band patch. Maybe it was planned that way, but I'll take it."

Last month, Microsoft fixed 20 flaws on its scheduled patch day and then nine days later issued an emergency update to stymie active attacks. That final vulnerability was exploited by even newer malware within days.

Kandek of Qualys argued that the Microsoft might have had no choice but to issue a lighter load of patches than usual. "I think it shows the limited resources that Microsoft has," he said, "not a lack of vulnerabilities. They had a lot of work last month and then the out-of-band update, so they might have had kinks in their schedule."

This month's two security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Copyright © 2008 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon