[ISN] Researcher to show code for 'wormable' Windows flaw

From: InfoSec News (alerts@private)
Date: Thu Jul 13 2006 - 01:15:41 PDT


By Robert McMillan
IDG News Service

With security vendors worrying that a recently patched Windows bug may 
lead to a major worm outbreak, the researcher who discovered the flaw said 
Wednesday that he is weeks away from releasing code that exploits the 

HD Moore, developer of the Metasploit hacking tool, has developed software 
that could be used to crash a system that has not received Microsoft's 
MS06-035 update, released Tuesday. However, the software could not be used 
to create the kind of self-replicating worm that some vendors see as a 
possibility, he said.

Microsoft fixed Moore's bug Tuesday in the MS06-035 update to its Windows 
Server services, which is used for file-sharing between PCs. Security 
researchers worry that if hackers find a way to reliably use this flaw to 
run their malicious code on PCs, this could lead to a widespread outbreak, 
similar to the Blaster outbreak in 2003.

Moore believes it is unlikely such a worm will emerge.

"The... bug is serious and can result in kernel-level memory corruption, 
but the chances of it becoming a working exploit are pretty slim," he said 
Wednesday in an e-mail interview.

Moore said that the numerous flaws in Microsoft's Office products that 
were patched Tuesday have more potential for exploitation by hackers.

NCircle Network Security had warned that this bug was the first serious 
vulnerability in 2006 with the potential to spawn a widespread worm. On 
Wednesday, the company said that Moore's assessment was good news for IT 
professionals. "I have a lot of respect for HD, and if he says it's hard, 
[to exploit the bug] then it probably is," said Mike Murray, nCircle's 
director of vulnerability research. "Since he's the one who discovered it, 
he's probably got the biggest head start on it."

However, nCircle and many other security researchers are taking a close 
look at the flaw. "If it's possible to write an exploit for this in any 
reliable way, it's going to be really bad," he said.

Microsoft downplayed the risk of a worm outbreak on Tuesday, saying that 
most Windows systems turn off the Windows Server service by default and 
pointing out that most firewalls block the SMB (server message block) 
protocol that is uses for communication.

But since most Windows machines use the service, the flaw is still a 
concern, according to Murray. "Firewalls are not enough," he said.

"That's the kind of message that they could get away with in 1995," Murray 
said of Microsoft's comments. "Vulnerabilities in SMB and RPC [the Remote 
Procedure Call interface] are the most serious that they have these days."

Whatever the risk, it will still be weeks before Moore releases his 
exploit code.

That's because it is connected to a second undisclosed flaw that affects 
many other software products. Moore is checking first to see which of 
these vendors have patched their products before releasing any information 
on either vulnerability.

Microsoft's MS06-035 bulletin can be found here: 

Attend the Black Hat Briefings and
Training, Las Vegas July 29 - August 3
2,500+ international security experts from 40 nations,
10 tracks, no vendor pitches.

This archive was generated by hypermail 2.1.3 : Thu Jul 13 2006 - 01:25:40 PDT