Researcher to show code for 'wormable' Windows flaw

The researcher who discovered a critical Windows vulnerability says he will release code that exploits it in a few weeks.

With security vendors worrying that a recently patched Windows bug may lead to a major worm outbreak, the researcher who discovered the flaw said Wednesday that he is weeks away from releasing code that exploits the problem.

HD Moore, developer of the Metasploit hacking tool, has developed software that could be used to crash a system that has not received Microsoft's MS06-035 update, released Tuesday. However, the software could not be used to create the kind of self-replicating worm that some vendors see as a possibility, he said.

Microsoft fixed Moore's bug Tuesday in the MS06-035 update to its Windows Server services, which is used for file-sharing between PCs. Security researchers worry that if hackers find a way to reliably use this flaw to run their malicious code on PCs, this could lead to a widespread outbreak, similar to the Blaster outbreak in 2003.

Moore believes it is unlikely such a worm will emerge.

"The... bug is serious and can result in kernel-level memory corruption, but the chances of it becoming a working exploit are pretty slim," he said Wednesday in an e-mail interview.

Moore said that the numerous flaws in Microsoft's Office products that were patched Tuesday have more potential for exploitation by hackers.

NCircle Network Security had warned that this bug was the first serious vulnerability in 2006 with the potential to spawn a widespread worm. On Wednesday, the company said that Moore's assessment was good news for IT professionals. "I have a lot of respect for HD, and if he says it's hard, [to exploit the bug] then it probably is," said Mike Murray, nCircle's director of vulnerability research. "Since he's the one who discovered it, he's probably got the biggest head start on it."

However, nCircle and many other security researchers are taking a close look at the flaw. "If it's possible to write an exploit for this in any reliable way, it's going to be really bad," he said.

Microsoft downplayed the risk of a worm outbreak on Tuesday, saying that most Windows systems turn off the Windows Server service by default and pointing out that most firewalls block the SMB (server message block) protocol that is uses for communication.

But since most Windows machines use the service, the flaw is still a concern, according to Murray. "Firewalls are not enough," he said.

"That's the kind of message that they could get away with in 1995," Murray said of Microsoft's comments. "Vulnerabilities in SMB and RPC [the Remote Procedure Call interface] are the most serious that they have these days."

Whatever the risk, it will still be weeks before Moore releases his exploit code.

That's because it is connected to a second undisclosed flaw that affects many other software products. Moore is checking first to see which of these vendors have patched their products before releasing any information on either vulnerability.

Microsoft's MS06-035 bulletin can be found here: http://www.microsoft.com/technet/security/bulletin/ms06-035.mspx

Join the newsletter!

Or
Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Essentials

Mobile

Victorinox Werks Professional Executive 17 Laptop Case

Learn more >

Exec

Budget

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?