Microsoft issues emergency patch

Out-of-cycle update fixes serious, wormable flaw.

Microsoft has issued an emergency update to cover a serious vulnerability in the Windows Server service, breaking its usual monthly 'Patch Tuesday' cycle of security fixes.

The flaw was considered serious enough to merit an urgent patch release, although Microsoft will only confirm having seen the usual 'limited, targeted' exploitation. The flaw was apparently uncovered by security researchers at Microsoft while investigating an extant trojan attack, and VB has already received several reports of such trojans taking advantage of the flaw in the Server service and file sharing.

With the nature of the flaw and the possibility of a specially targeted worm taking advantage of it to create a widespread outbreak, all users are being urged to patch as a matter of urgency. The updated October security bulletin from Microsoft is here, with blog entries from members of the security team here and from the Microsoft Malware Protection Center here. Alex Eckleberry at the Sunbelt blog compares the vulnerability and its potential for exploitation with the likes of W32/SQLSlammer and W32/CodeRed, here.

24 October 2008

Tags: microsoft, patch, patch tuesday, trojan, vulnerability, worm. del.icio.us digg this