October 23, 2008, 8:20 PM — Just hours after Microsoft posted details of a critical Windows bug, new attack code that exploits the flaw has surfaced.
It took developers of the Immunity security testing tool two hours to write their exploit, after Microsoft released a patch for the issue Thursday morning. Software developed by Immunity is made available only to paying customers, which means that not everyone has access to the new attack, but security experts expect that some version of the code will begin circulating in public very soon.
Microsoft took the unusual step of rushing out an emergency patch for the flaw Thursday, two weeks after noticing a small number of targeted attacks that exploited the bug.
The vulnerability was not publicly known before Thursday; however, by issuing its patch, Microsoft has given hackers and security researchers enough information to develop their own attack code.
The flaw lies in the Windows Server service, used to connect different network resources such as file and print servers over a network. By sending malicious messages to a Windows machine that uses Windows Server, an attacker could take control of the computer, Microsoft said.
Apparently, it doesn't take much effort to write this type of attack code.
"It is very exploitable," said Immunity Security Researcher Bas Alberts. "It's a very controllable stack overflow."
Stack overflow bugs are caused when a programming error allows the attacker to write a command on parts of the computer's memory that would normally be out of limits and then cause that command to be run by the victim's computer.
Microsoft has spent millions of dollars trying to eliminate this type of flaw from its products in recent years. And one of the architects of Microsoft's security testing program had a frank assessment of the situation Thursday, saying that the company's "fuzzing" testing tools should have discovered the issue earlier. "Our fuzz tests did not catch this and they should have," wrote Security Program Manager Michael Howard in a blog posting. "So we are going back to our fuzzing algorithms and libraries to update them accordingly. For what it's worth, we constantly update our fuzz testing heuristics and rules, so this bug is not unique."
While Microsoft has warned that this flaw could be used to build a computer worm, Alberts said that it is unlikely that such a worm, if created, would spread very far. That's because most networks would block this type of attack at the firewall.
"I only see it being a problem on internal networks, but it is a very real and exploitable bug," he said.
