Microsoft to fix password flaw, says researcher

SkyRecon talks up LSASS bug hours before Microsoft issues patch

Breaking an unwritten code of conduct, security researchers at SkyRecon Systems said that a password vulnerability they had reported to Microsoft will be patched by the developer later Tuesday.

Typically, researchers who work with Microsoft wait for the software company to release its monthly patches before they go public with their own accounts or advisories.

"The patch is coming out later today," said Sean Martin, a researcher at the security firm, when asked why SkyRecon disclosed the vulnerability prior to Microsoft issuing a fix.

According to Martin, the vulnerability lets attackers elevate access privileges and run code in Windows' LSASS (Local Security Authority Subsystem Service), the process responsible for enforcing security policy in the operating system. "Someone could use this to gain system-level access and extract passwords out of the Windows storage," Martin said this morning, several hours before Microsoft was scheduled to roll out January's security updates.

Microsoft last patched LSASS in April 2004; within weeks of posting MS04-011, the Sasser worm used the bug to wreak havoc around the world.

Tuesday's vulnerability should be considerably less dangerous; last week Microsoft classified a then-vague vulnerability as "important" rather than the top-end "critical" and labeled it as a "local elevation of privilege," which means that an attack requires local access.

Martin confirmed Tuesday that the SkyRecon bug and the rights elevation flaw Microsoft previewed last Thursday are one and the same.

The bug affects Windows 2000, Windows XP and Windows Server 2003, but not Windows Vista, according to the advance notification.

Martin also said SkyRecon believes attackers would be able to access all Windows passwords by exploiting the LSASS vulnerability, even those that had been encrypted.

Microsoft generally releases its second-Tuesday-of-the-month security updates between 1 p.m. and 2 p.m. EST.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

Family Friendly

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Stocking Stuffer

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?