Microsoft looking into new SMB vulnerability report

Powered by SC Magazine
 

Investigation begins at Redmond.

Microsoft is investigating a researcher's claim that the software giant's newest operating system contains a vulnerability that could be exploited to crash systems.

Researcher Laurent Gaffie published proof-of-concept code that allows an attacker to exploit a vulnerability in Windows 7 and Server 2008 Release 2.

The flaw, detailed by Gaffie in a blog post last week, lies in the Windows Server Message Block (SMB) and requires no user interaction to exploit.

Attackers can remotely crash systems if a victim machine receives malformed packets, Jonathan Leopando, a member of the Trend Micro technical communications team, said in a blog post.

"Whatever your firewall is set to, you can get remotely smashed via IE (Internet Explorer) or even via some NBNS (NetBios Name Service) tricks," Gaffie said.

Christopher Budd, security response communications lead at Microsoft, said in a statement that the software giant is aware of the purported vulnerability, which is said to cause a denial-of-service attack.

"We're currently unaware of any attacks trying to use the claimed vulnerability or of customer impact," Budd said. "Once we're done investigating, we will take appropriate action to help protect customers."

Users are encouraged to block ports used by the SMB protocol until Microsoft offers workarounds or permanent fix,  Leopando said.

In October, Microsoft patched another serious vulnerability in the SMB protocol that Gaffie discovered.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition


 
 
 
Top Stories
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
How technology will unify Toll
The systems headache formed through 15 years of acquisitions.
 
Immigration breached Privacy Act with data leak
Pilgrim slams "copy and paste" of asylum seeker data.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Optus steps up regional 4G coverage
Nov 20, 2014
Once 700Mhz services are working, Optus claims regional users will have a "faster and more ...
This Huawei 4G phone costs $99
Nov 12, 2014
The $99 Huawei Ascend Y550, available through Vodafone, enters the budget market as one of the ...
4G smartphones: Microsoft's Lumia 830
Nov 7, 2014
Microsoft has announced its flagship Windows Phone, the Nokia Lumia 830 4G, will be available in ...
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Optus expands 4G coverage
Oct 10, 2014
If you rely on an Optus phone for work you might be interested to know that there are now 200 ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 811

Vote