Exploits Circulating for Latest Windows Holes

1sockchuck writes "Exploits are already circulating for at least two (and possibly four) of the Windows security holes addressed in Microsoft's updates on Tuesday. Several working exploits have been released for a new vulnerability in Windows Plug and Play technology, which could be used to spread a worm targeting Windows 2000 machines, according to eEye security, which has released a free scanner to help network admins identify vulnerable computers."

Registration form privacy information at eEye

[mikeophile]

Our website's registration forms require users to provide contact information (names and email addresses) and financial information (account or credit card numbers). Financial information that is collected is used to bill the user for products and services purchased and is only used internally by eEye. Contact information is used to confirm and ship orders, to contact the user when necessary, and to notify users when new products and services are available. Users may choose not to receive future mailings from eEye; see the Choice/Opt-Out section below. eEye Digital Security may occasionally share visitor contact information with official product resellers that adhere to a comparable privacy policy; visitor contact information is NEVER given to other third-party vendors that are not affiliated with eEye.

Why do they insist on my personal information if they aren't going to use it?

They have the ability to let me opt out of of mailing, why don't they provide an opt out for my information in the first place?

It is interesting that...

[donleyp]

The exploits came out after the announcement and not before. It begs the question, do we need to give M$ credit for pushing the patch before the exploit became common knowledge? Compare this to Cisco who tried to squash recent publicizing of their vulnerability.

Free, but not without pain

[bitslinger_42]

Is anyone but me getting sick of these companies releasing "free" tools that require you to register for their incessant spam, phone calls, and other marketing harassment in order to download? Yes, I understand that they spent money to develop the tool, but what if I want to scan my home network? MySQL isn't too bad, at least. They have the marketing signup, should you be interested, but provide a link to download without all the crap.

[Wanders off muttering about the good old days of gopher and archie]

Unless I'm mis-reading this...

[goldspider]

...Microsoft patched the holes BEFORE the exploits started circulating?

If that's the case, what's the problem?

Re:It is interesting that...

[uqbar]

Cisco had also patched their vulnerability before the publicity. The whole point of the BlackHat presentation was to encourage admins to use the patch, and to shame Cisco for underplaying how serious the issue is.

In other news...

[Anonymous Coward]

Hundreds of vulnerabilities discovered in Linux since the release of a distro:

http://www.mandriva.com/security/advisories?dis=10 .1 [mandriva.com]

But of course, that's not newsworthy because it doesn't involve hating Microsoft. This ain't a troll; it's an attempt to show that BOTH systems have pretty lame security track records, yet all we hear about is Windows.

Look at that list above. Given 300 million clueless users running that Mandrake instead of Windows, don't you think there'd be exploits for that plenthora of holes too?

Re:Well give and take credit from Microsoft

[toddbu]

It's exactly this kind of argument that people need to make to their bosses when talking about using open source software. Your company should decide when the life of a piece of software is over, and they can make this decision on factors like "Do I want to patch this or install a new version?" And because some vulernable software like IIS is built right in, you can't just upgrade that one piece if the vendor decides they'll no longer fix it for your platform.

Microsoft's biggest problem really is all this integration that they do when it doesn't need to be done. Yes, it's nice that I can click on a link in an email and open a document in my browser. That's a good use of integration. But when much of the system depends on a couple of dlls that can't be upgraded without changing the whole system then that's not good at all. I think that there's a huge appeal to the F/OSS model and decoupling of software when it comes to this kind of thing.

Re:Unless I'm mis-reading this...

[Espectr0]

Simple. It is known that exploits are made after MS releases the patch, by reverse engineering them. Since 90% of the people is stupid and don't patch their systems (i made this up) then these people get hit.

My rant is not against MS. It's against people (supposedly people with knowledge) don't take the time to update their systems. SP2 actually improved this by trying to push the updates in the user's throats.

Re:Just Upgrade

[Skruffy42]

I still have people using 75Mhz machines with windows 95, and most of my users are running 2000. We don't need to or have the budget to upgrade everyone to a new box with XP on it just so they can use word/excel, and email each other porn.

Re:It is interesting that...

[timster]

The problem is that now it means both things, and every time you encounter it you have to reason out which meaning is being used. So it's currently better to not use the expression at all, and substitute "raises the question" for one meaning and "circular logic" for the other.

Evolution of language isn't a problem, but useless entropy like forgetting the meaning of an expression makes clear and effective writing more difficult. There are those of us who like to read clear and effective writing, so we wish that it were easier to do.

Re:In other news...

[BabyDave]

Hundreds of vulnerabilities discovered in Linux since the release of a distro:

http://www.mandriva.com/security/advisories?dis=10 [mandriva.com] .1

Of course, Windows doesn't come with the hundreds (thousands?) of applications that Mandriva does, and so it's a bit unfair to compare the Mandriva security advisory list (which includes fixes for MySQL, Apache, Perl, Mozilla, Vi, etc etc) to the Windows list.

Re:Just Upgrade

[Tourney3p0]

How exactly is Windows 2000 "out of date" by any standard except the date it was released? Windows XP is horrid compared to Windows 2000. Very few people I know have "upgraded" to Windows XP from Windows 2000. It's easier and cheaper to open the case and remove a stick of ram. Install a Yoshi's Island skin, and you have instant 2000->XP upgrade. Mentalities such as yours are why you need a 3 Ghz P4 and 512 MB of RAM just to open Microsoft Word in less than 30 seconds.

Re:It is interesting that...

[Sheepdot]

I haven't the faintest clue why your comment is insightful.

Let me give you some examples of exploits (ie worms) that came out after patches: Blaster, Sasser, Nimda (MS patched this 330 days before the worm actually hit). Code Red is the only one that immediately comes to mind as a worm that hit before the patch, and even in that case, MS didn't know ahead of time that IIS was exploitable. It was 0-day.

In the case of the Plug & Play exploit, it became common knowledge *because* of the patch, which was reversed engineered to see what it fixed.

In the case of the other item, Microsoft acknowledged earlier that spyware companies were already exploiting the java proxy dll 0-day and thus created the patch.

In the first case the patch made the exploit common knowledge, in the second, the common knowledge came before the patch. So the answer to your question is: no.

Don't get me wrong, MS is getting better about patching, and they should be commended for their efforts in finding the java proxy IE exploit "in the wild" on their own without a security company having to release anything, but they don't need to be commended for releasing their regular monthly patches.

Patching for security issues is not something that a vendor is rewarded for. They are expected to do it.