Windows Patch Tuesday Leaves 0-Day Flaw on Wednesday

Many articles about the last Patch Tuesday were almost puffing about the lack of fixes for Windows 7. It did appear that Windows 7 was doing better than almost any other operating system after release.

It was not to be however, as a story in ComputerWorld reveals the flaw reported in Windows 7 the very next day -

It was a notable accomplishment when Windows 7 was not impacted in any way by the vulnerabilities addressed in the six Security Bulletins released by Microsoft for the November Patch Tuesday. It would be even more impressive if Windows 7 proved invulnerable to the zero-day exploit that hit the next day.

This newly found bug was discovered by Laurent Gaffie and details were posted on the Full Disclosure mailing list. Microsoft is investigating the reported flaw which basically crashes a Windows 7 system when exploited. The issue is in the SMB (Server Message Block) protocol that forms the backbone of Windows file sharing. When triggered, the flaw results in an infinite loop which renders the computer useless.

Tyler Reguly, Lead Security Research Engineer with nCircle, explains “Exploitation of this vulnerability occurs when a user attempts to browse to Windows Share hosted on the malicious server. On Windows 7, the DoS (denial of service) will occur as soon as you type ‘\\<ip>\’ in the search box. “

The vulnerability actually impacts both Windows 7 and Windows Server 2008 R2. There are currently a couple different proof-of-concept exploits circulating, but there are no reported attacks in the wild at this point. Because the flaw only enables an attacker to crash the system, and doesn’t provide any unauthorized remote access that could lead to compromising information or performing other malicious activities, the odds of the exploit being actively used by attackers is fairly slim.

So it seems that it is only an annoyance, with little possibility of permanent damage to any system. Still, it is very strange that after almost 20 years of SMB protocol Microsoft has not made this thing absolutely bulletproof.

It has always been my understanding that user tests occur on large scale OS projects, as well as computerized usage. After getting that many years of shaking out the bugs, there simply should not be any.

I remember being told in a beginning programming class, that if a programmer wanted to make sure that error trapping was working properly on a project, turn a couple of 3 year-old children loose, and see what havoc they can wreak. Perhaps Microsoft never heard that. Certainly the ability of ‘computerized ruggedness checking’ to be employed, makes the appearance of these type of bug very disappointing.

§

⌘

⌘

over 20 years of repeated mistakes, and counting…

•