Critical flaw affects almost all Windows versions
By Brian Livingston
Every time Microsoft releases “the most secure operating system ever,” the security flaws just keep on coming. Last week, Microsoft notified users that a hole rated “critical” (the most severe rating) affects not only Windows XP, 2000, and NT 4.0, but also its new, much-vaunted Windows Server 2003 product. Microsoft says Windows Me is not vulnerable, but it didn’t test Windows 9x, which the company no longer supports.
This problem is especially explosive because an attacker can run a rogue program by merely sending packets to a remote machine using any one of various ports. One of these, port 135, is commonly used to send pop-up messages across a network. This feature has been notably exploited in recent months by some spammers, who started sending irritating – but otherwise harmless – ads directly to desktops. Now such payloads threaten to escalate wildly.
Corporations ordinarily block such port access if it originates from outside the firewall. But a malicious person inside the firewall could use the flaw to gain complete control over certain systems. And, of course, not all vulnerable systems are effectively protected by firewalls.
This situation is so dire that I’ve included more information in the paid version of this week’s newsletter; but if you don’t get that version, you should just go directly to Microsoft bulletin MS03-026 and download patches for your affected PCs. (Microsoft revised this bulletin as recently as July 21, so you should re-visit the document if you originally read it before that date.)
I haven’t learned of any negative side-effects of installing the patches, and in any event they would pale in comparison to the threat of your vulnerable machines remaining unpatched. If unexpected gotchas do arise, I’ll alert you in a future Brian’s Buzz. To send me more information about this, or to send me a tip on any other subject, visit WindowsSecrets.com/contact.
Top-scoring articles in the past 12 months
- Leaving long cookie trails throughout the Web 5.00
- Windows-like security for Android devices 5.00
- Win7′s no-reformat, nondestructive reinstall 4.53
- The sorry tale of the (un)Secure Sockets Layer 4.42
- RPV: Win7′s least-known data-protection system 4.33
- Recovery: the last step in total data security 4.30
- Time for a .NET update we can’t ignore 4.30
- Getting the most from Windows Search — Part 1 4.25
- Revising printing habits saves money and trees 4.25
- Upgrades end in erratic, partial hangs 4.25
- Pros and cons of a ‘keyfile’ password 4.21
- Beating back Duku and a plethora of other threats 4.20
- Office 2007 gets its final service pack 4.19
- Putting Registry-/system-cleanup apps to the test 4.19
- One year and 99 security bulletins later 4.18
- 1.8TB external drive goes down hard 4.17
- Don’t pay for software you don’t need — Part 3 4.16
- Internet Explorer gets another round of patches 4.15
- Is your free AV tool a ‘resource pig?’ 4.15
- Vacation’s over; it’s a big round of patches 4.15
- Remote access leads to remote attacks 4.15
- Keeping you up to date: say no to .NET — again 4.14
- Take control of Google’s privacy policy settings 4.14
- Office File Validation patch leads to problems 4.14
- The advanced system-recover toolkit 4.13
- New “419″ scam involves PayPal and Western Union 4.12
- Readers’ best personal-privacy tips 4.11
- Getting the most from Windows Search — Part 2 4.11
- Re-examining Dropbox and its alternatives 4.10
- Easily edit Windows’ right-click context menus 4.09
