Microsoft to issue patch for dangerous USB rootkit hole

Rare out of band patch should fix a scary vulnerability that has lead to espionage-like attacks.

Microsoft on Tuesday will release a rare out-of-band patch to fix the highly dangerous zero-day vulnerability that has caused multiple researchers to issuing warnings earlier this month. The patch will be for all supported versions of Windows and will require a restart.

As I previously wrote about, the exploit is a whopper on all levels. It comes into the enterprise via hidden files on USB sticks or via shared network files. It requires no user interaction to infect the system (simply viewing the icon is enough to trigger it). It propagates itself. It loads as a rootkit infection. It affects all Windows operating systems, even full-patched Windows 7 systems. It seems to target extremely sensitive information -- researchers say it seems to have been made for espionage. If all that weren't scary enough, a researcher has already published proof-of-concept code.

The attack exploits a vulnerability in Windows Shell, a component of Microsoft Windows. Although many anti-virus software makers claimed that they were able to update their wares to detect the rootkit, security experts remained highly concerned about the hole, as did Microsoft. In a blog post today, Christopher Budd, Sr. Security Response Communications Manager at Microsoft, explained, "we're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability."

Microsoft will also hold a special edition of the bulletin release webcast on Monday, August 2, 2010 at 1:00 PM PDT. If you are interested in attending the webcast, click here to sign up.

Other articles Network World has published that discusses the attacks include:

Ms. Smith's report on the hole and how it targets espionage. (Includes links to various researcher's reports)

Microsoft confirms 'nasty' Windows zero-day bug (no patch will be forthcoming for Windows 2000)

Microsoft's actual security alert and recommended workarounds.

One researcher publishes exploit, another claims Microsoft's workarounds won't work

Check out these other posts from Microsoft Subnet

• All of today's Microsoft news and blogs
• Nearly half of Microsoft's 2010 security patches have known problems
• Microsoft fixes buggy patch for Windows Server 2008
• Why Microsoft and HP need each other
• Microsoft was against software patents before it was for them
• How to create custom AD LDS attributes
• Microsoft's cloud is slower than Google's, Amazon's, benchmark says

Like RSS? Subscribe to all Microsoft Subnet bloggers.
Like e-mail? Sign up for the bi-weekly Microsoft newsletter. (Click on News/Microsoft News Alert.)
Like Twitter? Follow All Microsoft Subnet bloggers on Twitter @microsoftsubnet

Follow Julie Bort on Twitter @Julie188 or connect with me on my Facebook Like Page

• Microsoft
• Microsoft patches
• Microsoft security
• patches
• rootkits