Microsoft patching zero-day Windows 7 SMB hole
Microsoft on Friday said it is working on a fix for a vulnerability in the Server Message Block file-sharing protocol in Windows 7 and Windows Server 2008 Release 2 that could be used to remotely crash a computer.
The software giant had said on Wednesday that it was looking at the bug, discovered by researcher Laurent Gaffié, who published proof-of-concept code on a blog.
"Microsoft is aware of public, detailed exploit code that would cause a system to stop functioning or become unreliable. If exploited, this [denial-of-service] vulnerability would not allow an attacker to take control of, or install malware on, the customer's system but could cause the affected system to stop responding until manually restarted," Dave Forstrom, group manager for public relations at Microsoft Trustworthy Computing, said in a statement. "It is important to note that the default firewall settings on Windows 7 will help block attempts to exploit this issue."
Microsoft is not aware of attacks to exploit the hole at this time, he said.
In an advisory, Microsoft criticized the way Gaffié handled the discovery.
"Microsoft is concerned that this new report of a vulnerability was not responsibly disclosed, potentially putting computer users at risk," the advisory said. "We continue to encourage responsible disclosure of vulnerabilities."
The advisory suggests that customers block Transmission Control Protocol, or TCP, ports 139 and 445 at the firewall, as a workaround until a patch is ready.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Well, they are in the same food group. ;)
Attention Mac Users: IMPORTANT NOTICE ABOUT SNOW LEOPARD!
It has come to our attention that the early release of the latest upgrade to Apple's operating system, OS X v10.6 (Snow Leopard), causes significant compatibility issues with eInstruction clickers. As it is difficult to revert back to a previous version of the operating system, we highly recommend that eInstruction users DELAY UPGRADING TO SNOW LEOPARD until eInstruction®can address these issues and provide full support for our family of products.
I see you failed to see the point here. I brought up the MSFT vs Apple issue in hopes that people would realize how silly and stupid it is to debate such things endlessly. And baed on the comments here so far, that attempt was successful. :)
You don't know much do you about what goes into it to roll out a patch on a world-wide scale in such a widely used product. It cannot be done in three days, it takes a least a month minimum to verify the vulnerability, documentation prepared, the patch developed and tested to meet the requirement.
If Microsoft rushed a patch and it wasn't to the correct standard and it crashed every system world-wide, there would be an outcry.
There is no excuse for what Gaffié did, he has no respect for Microsoft, its customers or internet security and the security industry of security professionals.
Keep in mind security professionals need to test the Microsoft patches in-house before they get rolled into individual corporate networks even if a patch is released.
It's everybody affected by such bad disclosures as this not just Microsoft. If you think this is teaching Microsoft a lesson its not, its a sure way to get everyone in the security industry not to like you though.
Security professionals are happy with the required time it takes Microsoft to release a patch, it cannot be done any faster than it is currently.
Gaffié is a loner on this issue if he thinks direct action will change corporate policy, its border-line cyber-terrorism.
November 8th, 2009: MSRC contacted
November 8th, 2009: MSRC acknoledge the vuln
November 11th, 2009: MRSC try to convince me that multi-vendor-ipv6 bug
shouldn't appears on a security bulletin.
November 11th, 2009: Win 7 remote kernel smash released
Most updates are plus 100mb's and many over 300mb's. Also, their naming and filing systems for it are, well, out dated.
"No comment"
In the response to your comment of "no comment," I have only this to say:
No response necessary.
And unlike OS X users we don't have to wait for months and downloads 100s of MB of security updates. Kudos to Microsoft :)
Shocking story that they released software that had security problems.....it's not like them.
But you know what? I don't care as long as the products get updated however it happens.
- by gertruded November 14, 2009 8:13 AM PST
- Trust Me.
- Like this Reply to this comment
-
(28 Comments)