Windows Attack Now Public - Pressure mounts on Microsoft

[HappyAndyK]

Hackers have publicly released new attack code that exploits a critical bug in the Windows operating system, putting pressure on Microsoft to fix the flaw before it leads to a worm outbreak.

The vulnerability has been known since Sept. 7, but until today the publicly available programs that leverage it to attack PCs haven't been able to do more than crash the operating system. A new attack, developed by Harmony Security Senior Researcher Stephen Fewer, lets the attacker run unauthorized software on the computer, in theory making it a much more serious problem. Fewer's code was added to the open-source Metasploit penetration testing kit on Monday.

Unlike Conficker, however, this attack would not affect Windows XP, Windows Server 2003, or Windows 2000 systems.

That's because the underlying flaw that all of these programs exploit lies in the SMB (server message block) version 2 system, introduced in Vista. Microsoft has confirmed that Immunity's attack works on 32-bit versions of Vista and Windows Server 2008, but did not have any immediate comment on the Metasploit code.

The flaw has been patched in Windows 7, Kortchinsky said. On Sept. 18, Microsoft released a Fix It tool that disables SMB 2, and the company said that it is working on a fix for the software.

by : Yahoo! Tech

[rkonit]

The flaw has been patched in Windows 7, Kortchinsky said.

Thanks Microsoft ! I'm using Windows 7.

[nitinagarwal1988]

I'M too using Windows 7....Safe & Secure

[leofelix]

here is the exploit working

https://www.immunityinc.com/documentation/smbv2.html

[HappyAndyK]

Thanks for the link leo!

[James]

The most important facts for the Windows Vista home user (from the MS Security Research site):

Consumers (not part of an enterprise network) are protected by the on-by-default firewall included in Windows Vista:

• The on-by-default Windows firewall protects vulnerable systems
• The on-by-default Windows firewall allows packets through only if a user explicitly shares a folder or printer.
• When a Windows Vista user chooses the ‘Public’ firewall setting, the firewall will block packets even if a folder or printer has been shared.