Microsoft confirms it missed Stuxnet print spooler 'zero-day'

Researcher published info, exploit on print spooler vulnerability in April 2009

Contrary to reports, a bug that Microsoft patched last week had been publicly discussed a year and a half ago, security researchers said this week.

Microsoft confirmed Wednesday that it overlooked the vulnerability when it was revealed last year.

The vulnerability in Windows Print Spooler service was one of four exploited by Stuxnet, a worm that some have suggested was crafted to sabotage an Iranian nuclear reactor .

Last week, researchers at both Kaspersky Lab and Symantec, the firms that had reported the bug to Microsoft in July and August, respectively, said the print spooler vulnerability had not been publicly disclosed before they found Stuxnet was using the flaw.

Stuxnet raised the eyebrows of security experts for a variety of reasons, including its use of four different unknown, unpatched Windows vulnerabilities. Such bugs are often labeled "zero-days" because attackers exploit them before the relevant developer knows of the flaw.

It turns out that one of the four -- the vulnerability Microsoft patched last week with its MS10-061 update -- was technically not a zero-day, said Liam O Murchu, manager of operations with Symantec's security response team.

According to O Murchu, the print spooler flaw was first revealed in a security publication's 2009 issue. He did not name the magazine. On Wednesday, a Symantec spokesman declined to identify the publication, saying the article "has the source code needed to carry out the attack, info which is not publicly known yet."

But the cat is already out of the bag.

Paris-based Vupen Security , however, pointed a finger at Hackin9 , a Polish publication. Computerworld was easily able to locate a PDF of the 2009 issue on the Internet.

In that issue, a researcher named Carsten Kohler spelled out how to abuse the print spooler service to hijack Windows PCs and even included source code for a working exploit.

An exploit for the MS10-061 bug has also been added to the open-source Metasploit penetration testing framework by researcher Joshua Drake, who posted his attack code last Friday.

In an updated blog post , Symantec's O Murchu said Microsoft had told him that the Sept. 15 MS10-061 update patched the flaw that Kohler had exploited in his write-up.

Microsoft confirmed that today.

"Microsoft is aware of claims that the print spooler vulnerability in MS10-061 was partially discussed in a publication in April 2009," said company spokesman Dave Forstrom in an e-mail Wednesday. "These claims are accurate. Microsoft was not directly made aware of this vulnerability nor its publication at the time of release."

Forstrom went on to say that the bug was independently "re-discovered during the investigation of the Stuxnet malware" by Kaspersky Lab and Symantec.

The security firms also notified Microsoft of two other unpatched bugs that the Stuxnet worm exploited. Those flaws, which can be used by attackers to upgrade access privileges on compromised PCs to administrator status, will be patched in a future update, Microsoft said last week. It has not set a timetable for the fixes, however.

Little information is available about the two lesser vulnerabilities. Danish bug tracker Secunia, for example, has posted only bare-bones advisories, noting that one affects Windows XP while the other affects Vista and Windows Server 2008 machines.

Users can protect their computers against the print spooler exploits by downloading and installing MS10-061 via the Microsoft Update and Windows Update services, or through Windows Server Update Services.

Join the PC World newsletter!

Error: Please check your email address.

Tags symantecMicrosoftsecurityWindowssoftwareMalware and Vulnerabilitiesoperating systemskaspersky lab

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?