Microsoft Posts "Critical" Windows XP Patch

Microsoft Corp. posted a "critical" security patch for Windows XP, and a digital security outfit called eEye claimed credit for finding the "major vulnerabilities" in the new OS.

by Beth Cox of internetnews.com [December 21, 2001]

Redmond, Wash.-based Microsoft posted on its site that the impact of the vulnerability is to allow someone to "run code of attacker's choice." Microsoft stock was falling after word of the security flaw surfaced. It was down $1.93 at about 2:30 PM yesterday, to $67.56.

Furthermore, Microsoft said that "customers using Windows 98, 98SE, or ME should also apply the patch if the Universal Plug and Play service is installed and running." The patch can be found here.

Aliso Viejo, Calif.-based eEye Digital Security put out a press release "announcing the discovery of major security vulnerabilities in Microsoft's UPNP (Universal Plug and Play) Service."

The company said that Windows XP, by default, ships with a UPNP Service that can be used to detect and integrate with UPNP-aware devices.

eEye said it has discovered three vulnerabilities within Microsoft's UPNP implementation: a remotely exploitable buffer overflow that allows an attacker to gain system level access to any default installation of Windows XP, a Denial of Service (DoS) attack, and a Distributed Denial of Service (DDoS) attack.

The most serious of the three Windows XP vulnerabilities is the remotely exploitable buffer overflow, eEye said. It is possible for an attacker to write custom exploit code that will allow them to execute commands with system level access, the highest level of access within Windows XP.

The other two vulnerabilities are types of denial of service attacks. The first is a straightforward denial of service attack, which allows an attacker to remotely crash any Windows XP system. The crash will require users to power down their machines and start them up again before the system will function.

The second denial of service attack is a distributed denial of service attack. This vulnerability allows attackers to remotely command many Windows XP systems at once in an effort to make them flood/attack a single host.

Privately held eEye Digital Security is a developer of high-end network security products, including Retina, its flagship network vulnerability scanner.

— End