SecureData, a member of the JSE-listed ERP.com Group and the Southern African Enterprise Partner for eEye Digital Security, today announced details for four new vulnerabilities related to Microsoft Windows, one of which has immense potential to result in a worm. This highly 'wormable' security vulnerability, located within the Windows 2000 Operating System, is currently found in a large percentage of all business systems running Windows today and has the potential to inflict as much damage as the previous Sasser and Blaster worms. Other critical discoveries include remotely exploitable flaws in Windows Media Player, Windows ActiveX and Plug and Play service of the Windows OS. These critical security flaws affect unpatched Windows NT, 2000, XP and Windows Server 2003 machines. eEye has also made a free scanning tool available for enterprises to detect the Windows 2000 vulnerability.
The volume of patches announced today illustrates that critical, remotely exploitable flaws continue to be found within the Windows operating system," commented Marc Maiffret, eEye's co-founder and chief hacking officer. "Even with Microsoft's recent efforts to improve its security posture, IT departments must continue to view patching and remediation as a priority. In order to fully protect their networks and minimise the impact of patching on department resources, these enterprises should strongly consider additional strategies such as upgrading their operating systems or deploying endpoint security such as eEye's Blink solution."
The critical vulnerabilities announced today could allow an attacker to take complete control of an affected system. If left unpatched, an attacker could then take harmful action including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. All of these security flaws can be detected and exploited remotely with the potential to cause serious damage if not immediately resolved. Those organisations that are utilising eEye's Retina Network Security Scanner can immediately scan for affected systems. Organisations that have deployed the Blink Endpoint Intrusion Prevention System have been protected against these vulnerabilities since their discovery several months ago and can postpone patching to regularly scheduled maintenance cycles.
The most significant of these flaws is found in the Microsoft Distributed Transaction Coordinator (MSDTC) service within the Windows 2000 OS. When exploited, this flaw gives attackers the ability to run remote commands on the affected system using system privileges, which is the highest level of privileges possible and would allow these attackers to do anything they wished with the system. Large enterprises are particularly susceptible to this vulnerability, as the MSDTC service is primarily used for enterprise-wide applications (such as distributed database applications), as well as load balancing Web servers. Given that larger organisations often have the most difficulty quickly patching vulnerable systems, a worm based on this vulnerability would be extremely damaging to large enterprises, as it targets the gateway to their most valuable digital assets.
With millions of installations around the world, Windows 2000 represents a significant percentage of all Windows servers running today. eEye strongly recommends that these organisations upgrade to Windows 2003, which is a more secure OS. For those organisations that do not have the ability to upgrade, they should evaluate an endpoint security product that can protect against such vulnerabilities.
eEye is committed to enhancing security for the Internet community and helping companies maintain a safe computing environment by offering a free scanning tool to facilitate the discovery of vulnerable machines. The Retina MSDTC Scanner audit tool scans networked systems and detects if any are vulnerable to the critical MSDTC vulnerability announced today, allowing administrators to take steps to protect their networks. This audit tool is based on eEye's award-winning Retina Network Security Scanner product. While this particular tool allows for a quick audit for this vulnerability, the complete Retina product detects thousands of vulnerabilities to provide ongoing, comprehensive vulnerability assessments for any network. Existing Retina customers have already received their updated audit package and can scan for all of the vulnerabilities announced today.
Share
Over the last five years, eEye has been recognised by industry experts as the pre-eminent organisation in the discovery of the most critical vulnerabilities in various platforms and applications, including the vulnerabilities subsequently leveraged by the Sasser, Witty, Code Red and Sapphire worms, as well as the Microsoft ASN vulnerability and hundreds of other important discoveries. This expertise gives eEye a distinct advantage in designing services and software solutions for the assessment, remediation and prevention of vulnerabilities and the attacks that leverage them.
eEye's integrated family of vulnerability management solutions helps IT and security professionals confidently safeguard their valuable digital assets. Working in conjunction with popular tools such as firewalls and intrusion detection systems, eEye's products include: Retina(r) Network Security Scanner, REM(tm) Security Management Console, Iris(r) Network Traffic Analyzer, SecureIIS(tm) Web Server Protection, and Blink(r) Endpoint Intrusion Prevention System.
eEYE Digital Security
eEye Digital Security is a leading developer of network security software, and the foremost contributor to security research and education. eEye's award-winning software products provide a complete vulnerability management solution that addresses the full lifecycle of security threats: before, during and after attacks. eEye protects the networks and digital assets of more than 8,400 corporate and government deployments worldwide, including Avon, Citigroup, Continental Airlines, The U.S. Department of Defense, Dow Jones, Prudential, University of Miami, Viacom, Vodafone, Warner Music and Wyeth. Founded in 1998, eEye Digital Security is a privately held, venture-backed firm with headquarters in Orange County, California.
For more information, please go to www.eEye.com.
SecureData
SecureData, an ERP.com company, is Africa's Premier IT Security Solution Provider. SecureData's solutions incorporate Antivirus and Content Security, Endpoint Security, Network Security, Intrusion Prevention and Authentication & Identity Management. SecureData's comprehensive "Managed Security Services" include design, audit, implementation, vulnerability assessment, out sourcing and hosting. SecureData distributes, sells and supports category leading IT security products to the public, corporate and SME sectors throughout Africa as well as products and services to the SOHO and consumer markets through partnerships with ISPs. As well as being the sole distributor in Sub-Saharan Africa for Trend Micro, SecureData is the Sub-Saharan African distributor for USA-based TippingPoint Technologies as well as for Application Security, eEye, Precise Biometrics, Red-M, Rocket Software, RSA Security, SPI Dynamics, St Bernard and Websense.
For more information, visit SecureData at www.securedata.co.za
ERP.com
ERP.com is a JSE-listed company focused on the implementation, integration and management of enterprise applications in an e-business environment. For more information, visit ERP.com at www.erpcom.co.za
Editorial contacts