Microsoft fixes widespread Windows vulnerability

A new security vulnerability for Windows systems was announced last week which could allow malicious attackers to run virtually any command or software on machines they can access.  The vulnerability is in the Remote Procedure Call, or RPC, functionality of Windows NT, Windows 2000, Windows XP and Windows Server 2003.

RPC technology allows a program running on one computer to connect to, and run software on, another remote computer without knowing details of the remote system. Client-server computing, for example, is an implementation of the RPC technology. When a database client application requests data from SQLServer it uses RPC technology to specify parameters of the data but it’s the server software that executes the code and returns the data to the client.

The affected Windows operating systems all listen on TCP port 135 for RPC calls. The newly discovered vulnerability involves an old nemesis, the buffer overflow. A quick search on Network World Fusion brings up over 350 hits on the phrase “buffer overflow” – and that’s only searching material published in the past two years.

This is a very critical flaw, which should be patched as soon as possible. The patch is available right now from Microsoft’s security bulletins page (see link below). Windows XP, Win 2000 and Win2K3 machines with “Auto Update” enabled will already have retrieved the patch.

The good news is that almost all firewalls block TCP port 135 from outside access by default so most installations should be protected from Internet hackers. People without firewalls – typically home, SOHO and small business users – are extremely vulnerable and should probably drop everything to install this patch. You should tell everyone you know, especially those who don’t read security bulletins, what to do to protect themselves. Indeed, it wouldn’t be a bad idea to let all of your users know so that they can, in turn, protect their personal machines.

Poland’s Last Stage of Delirium (LSD) Research Group (https://lsd-pl.net/), which discovered this security, flaw was exemplary in its handling of the situation. It documented the problem while keeping Microsoft informed of its findings. It also refrained from boasting about discovering the exploit or bragging about its prowess until the fix was in place so that not only was panic among users avoided but no known exploits of the flaw were known to occur.

For its part, Microsoft reacted remarkably well for a company whose security flaws are seemingly trumpeted on the front page of daily newspapers. The company listened to LSD, duplicated the problem and moved quickly to fix it on all affected platforms.

While its unfortunate that the problem even existed, Microsoft deserves to be commended for its actions providing a fix.