Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Microsoft working to close 8-year-old Web proxy vulnerability

By John Fontana , Network World , 11/26/2007
  • Share/Email
  • Comment
  • Print

Microsoft is working on a fix for an eight-year-old flaw in Windows that lets hackers exploit a Web proxy autoconfiguration protocol and take over groups of machines via a single attack. Microsoft has yet to release the update it has been working on since last week that addresses the vulnerability in the Web Proxy Autodiscovery Protocol (WPAD) in Windows. 

The flaw was first discovered in 1999, and some experts say it has never been adequately patched.

The flaw affects all versions of Windows including Vista, but does not affect computers in the United States. Microsoft reportedly patched the flaw eight years ago to protect computers that use the “.com” domain as part of their corporate identity. The fix, however, does not work for computers that use domain country codes, such as .nz (New Zealand) or .uk (United Kingdom).

WPAD is a method used by Web browsers to locate a proxy configuration file called wpad.dat that is used to configure a Web browser’s proxy settings. Part of the flaw lets the search for the configuration file leave the safety of the corporate network, thus opening an avenue for a hacker to hijack the request and deliver a configuration file to the browser that could then be then exploited to intercept and modify the user’s Web traffic.

The Windows WPAD feature was designed so administrators would not have to configure browser proxy settings on each desktop manually. All the automated WPAD configuration work takes place out of view of the user.

Last week, Beau Butler, who also goes by the name Oddy and the title “ethical hacker,” presented his rediscovery of the WPAD flaw at the annual Kiwicon security conference at Victoria University of Wellington in New Zealand. Butler told conference attendees and Australia’s The Age Web site that he found 160,000 computers in New Zealand using the .nz domain that were vulnerable to the WPAD flaw. The Age said Microsoft asked it not to publish the details over fears they could be used by cybercriminals to seize control of workstations. Microsoft confirmed it was a serious issue, The Age said.

Some details about the vulnerability, however, are available by doing simple queries on Microsoft’s own Live Search Web site. Additionally, Microsoft publishes Knowledge Base articles on its Web site describing how WPAD works.

  • Share/Email
  • Comment
  • Print
Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comments (2)
Login
Forgot your account info?

Proxy Fix? HhahahahahahahahaBy meatpieandtatters on November 28, 2007, 7:21 amMS only fixes something when they absolutely have to and only does enough to cover their rear ends. Their usability paradigm is the antithesis of security.

Reply | Read entire comment

RE: Microsoft working to close Web-proxy vulnerabilityBy cara mitchell on November 26, 2007, 5:05 pmthis is a good idea from microsoft. i think that they can improve on their revenue with this idea.

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Windows Vista: Necessity and Opportunity

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

Security Considerations When Deploying Remote Access Solutions

Effective network security is most successful when you use a layered approach, with multiple...

Webcasts

Migrating to Windows Vista: Necessity and Opportunity

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...

Turning information into a Competitive Advantage

Companies today are realizing that competitive advantage is harder to sustain when based solely on...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Special Reports

Unified Threat Management from CheckPoint

Discover why Unified Threat Management Firewalls are ready for the enterprise today. High...

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.
Network World,to go. Wherever you are. Breaking news delivered to your mobile device. Select the hottest topics in networking and start receiving Network World on your mobile device today.