Ginormous Windows remote code execution vulnerability

[bascule]

http://support.microsoft.com/kb/958644

There's a remote code execution vulnerability in virtually every relevant version of Windows released. The vulnerability is in the "Server service", which provides file and print sharing among other things.

Raise your hand if you think a new worm is on the way...

[bascule]

Re: Ginormous Windows remote code execution vulnerability

Here's a bit more information on it:

http://www.infoworld.com/article/08/...s_patch_1.html

[TheCotMan]

Re: Ginormous Windows remote code execution vulnerability

Yep. A new work is almost certain. So, which spammer will have a brand new pack of zombie hosts? Any guesses on what abusive purpose will be first to take advantage of this as a worm? Distributed password cracking? Spamming? Click-through banner and advertising hit augmentation? pop-up software installs? Torrent servers or file servers for "warez" (illegally pirated software.)

[Thorn]

Re: Ginormous Windows remote code execution vulnerability

MS is sending this out aggressively on the Automatic Update system, and MS Partners have been sent an email saying that this is a high priority patch for themselves first and then all their clients.

[C-Rex]

Re: Ginormous Windows remote code execution vulnerability

Got myself a front row seat here at the ol'MS datacenter.
A lot of frantic patching goin on round here.

Also, New York Times reporting exploit code is now live.

My poor servers at home! God! When will this shift END!

[Gadsden]

Re: Ginormous Windows remote code execution vulnerability

Yup.. cover your cornholes.. it is gone from being silently exploited in the wild to a worm/trojan:
http://security.blogs.techtarget.com...vulnerability/

[TheCotMan]

Re: Ginormous Windows remote code execution vulnerability

Yep. A new work is almost certain. So, which spammer will have a brand new pack of zombie hosts? Any guesses on what abusive purpose will be first to take advantage of this as a worm? Distributed password cracking? Spamming? Click-through banner and advertising hit augmentation? pop-up software installs? Torrent servers or file servers for "warez" (illegally pirated software.)

Yup.. cover your cornholes.. it is gone from being silently exploited in the wild to a worm/trojan:
http://security.blogs.techtarget.com...vulnerability/

I guess the winner payload of the first exploit is, "Data Harvesting/Credential Harvesting."

Nice link che. :-)

[0x58]

Re: Ginormous Windows remote code execution vulnerability

Exploit proof of concept is up on milw0rm in case anyone is interested in the code!

[Gadsden]

Re: Ginormous Windows remote code execution vulnerability

Snort sigs here:
http://www.emergingthreats.net/cgi-b...PLOIT_MS08-067

[xor]

Re: Ginormous Windows remote code execution vulnerability

Anyone have a time lime on this? Just curious.

xor

By the way Kudos to Bascule for always being on top of this stuff. We need to give him an award or something. I bet you were awesome at quick draw as a kid.

[bascule]

Re: Ginormous Windows remote code execution vulnerability

So yeah, the answer is "yes"