Microsoft issues emergency patch

Out-of-cycle update fixes serious, wormable flaw.

Microsoft has issued an emergency update to cover a serious vulnerability in the Windows Server service, breaking its usual monthly 'Patch Tuesday' cycle of security fixes.

IAM Gartner 2008/09 (contradeal)

The flaw was considered serious enough to merit an urgent patch release, although Microsoft will only confirm having seen the usual 'limited, targeted' exploitation. The flaw was apparently uncovered by security researchers at Microsoft while investigating an extant trojan attack, and VB has already received several reports of such trojans taking advantage of the flaw in the Server service and file sharing.

With the nature of the flaw and the possibility of a specially targeted worm taking advantage of it to create a widespread outbreak, all users are being urged to patch as a matter of urgency. The updated October security bulletin from Microsoft is here, with blog entries from members of the security team here and from the Microsoft Malware Protection Center here. Alex Eckleberry at the Sunbelt blog compares the vulnerability and its potential for exploitation with the likes of W32/SQLSlammer and W32/CodeRed, here.

24 October 2008

Tags: microsoft, patch, patch tuesday, trojan, vulnerability, worm.    del.icio.us  digg this! digg this

0 comments

Leave a comment


Poll

Who in your company is responsible for installing software patches?
System administrators
End users
I don't know

Leave a comment

Jobs Career Sidebar

Jobs

In Virus Bulletin's jobs pages among others:
Virus Bulletin currently has 148,292 registered users.