Microsoft has warned customers about exploit code circulating on the Net, seeking to exploit 20 gaps in its software, some of them critical. The vulnerabilities were announced in Security Bulletin MS4-011 on April 13, with exploit code surfacing the very next day, according to international reports.
Microsoft appears to have taken a lot longer to react. On Friday, nine days later, according to these reports, it warned that it "considers these reports credible and serious and continues to urge all customers to immediately install the MS4-011 update as well as the other critical updates provided on April 13, 2004."
Bombshell
This advisory mentions a slew of vulnerabilities, 20 in all, for which only four patches were released. Windows XP and XP Service Pack 1, XP 64-bit edition SP1, Windows Server 2003 and Microsoft NetMeeting are all affected, but most of the holes affect Windows NT 4.0 and Windows 2000.
According to reports, the exploit code is known as "SSL Bomb". It can be used to exploit one of the flaws - the PCT/SSL vulnerability (Private Communications Transport/Secure Socket Layer), leaving servers open to a denial of service (DOS). Malformed SSL packets can force Windows 2000 and Windows XP machines to stop accepting SSL connections, and cause Windows Server 2003 to reboot.
The company stressed that customers who installed and deployed the patch are not at risk, nor are those who deployed Windows Server 2003 or Windows XP in their default configurations.
"For Windows Server 2003 customers using IIS (Internet Information Server), even if SSL is enabled, the vulnerable code is disabled by default. Windows Server 2003 is only vulnerable if an administrator has enabled PCT manually. Customers who have deployed MS04-011 are not
at risk from this exploit code."
Microsoft added that customers still evaluating and testing the patch should implement the workarounds detailed for the PCT/SSL vulnerability detailed in the MS04-011. In addition, Microsoft has published a knowledge base article.
"Customers who believe they have been attacked by someone seeking to exploit the vulnerabilities addressed in any Microsoft security bulletin should contact Microsoft Product Support Services for support on 0860 225567, or visit www.microsoft.com/southafrica/security," the statement concluded.
Share
