Manage updates with the Download App
July 15, 2005 2:23 PM PDT
Windows flaw could spawn DoS attacks
- Related Stories
-
PCs falling victim to Windows flaws
July 12, 2005
The flaw affects the Windows Remote Desktop Service, which lets users access their Windows PC from a remote location. An attacker could remotely exploit the problem to crash a victim's PC in what's known as a denial-of-service attack, according to a posting on the Security Protocols Web site earlier this week. The user would then see the Windows "blue screen of death."
Microsoft knows of the security flaw and is working on a patch, a company representative said on Friday.
"The issue was originally privately reported to Microsoft and we are working on an update that will be released when it is of the appropriate quality," the representative said. "The concern is that this has now gone public, potentially putting customers at risk."
According to the Security Protocols Web site, Microsoft was informed of the problem on May 4 and plans to release a patch as part of its August update cycle. Fully patched Windows XP machines--including those with the Service Pack 2 update and the firewall enabled--are vulnerable, according to Security Protocols.
In its initial review of the bug, Microsoft found that an attacker would not be able to run code on the victim's PC, but the attacker could cause the computer to stop responding, the representative said. Also, only computers that have the Remote Desktop Service enabled are vulnerable, she said. Windows ships with the service disabled, according to Microsoft.
Security researchers at iDefense are also looking into the vulnerability. "It does not look like it is more than a DoS," said Michael Sutton, a lab director at iDefense. "An attacker won't be able to take over your PC, but could knock it offline."
Security monitoring company Secunia rates the vulnerability "moderately critical," it said in an advisory issued on Thursday.
Microsoft said it is not aware of attacks that try to use the new vulnerability.
Reports of the new Windows flaw come in the same week that Microsoft patched two "critical" Windows vulnerabilities. Both those Windows flaws are actively being exploited by attackers, the Redmond, Wash., software giant said on Tuesday.
7 comments
Join the conversation! Add your comment
system?
Why would you feel it necessary to put millions of PC users at
risk of a DoS attack, in lieu of just patching the problem like you
have been in the past 3 and a half years.
At this point in time you [Microsoft] are knowingly and willingly
putting consumers at risk of damaging important data across
the board, including but not limited to consumers and
corporations alike.
Your laid back approach to security patches that deal with
worms and virus' are convienent to your opperation at the cost
of consumers'. This is a practice that seems evident at Microsoft
over the course of the companies existance.
In retrospect, why would you [Microsoft] think that your next
operating system would show any improvement or gain over the
prevailing OS, XP?
The technologies that you represent in future OS's is that of
"yesterday's news", and have been used by the likes of Apple and
the Mozilla Foundation in previous years.
The be all, end all question is?
It's almost four years Microsoft, over 300 security holes and
counting; how can you improve that in your upcomming
Operating System?
-Justin
Thank God for my linux desktop with an uptime of 6 months. Cnet should go out and find some real news like: windows not crashing for an instance (and I don't mean the Microsoft funded 'independent' surveys).