24 Oct 2008
Microsoft has issued a 'critical' fix for Windows users following reports of targeted attacks against a vulnerability in the server component for all currently supported versions of Windows and Windows Server.
An attacker could exploit the flaw by sending a specially-crafted Remote Procedure Call packet. A successful exploit would allow the attacker to remotely execute code on the target system.
The reported attacks are believed to be targeted and not widespread, but Microsoft is releasing a fix for the flaw through its automatic update services.
The bulletin is rated 'critical' for all versions of Windows and Windows server with the exception of Windows Vista and Server 2008, which carry a less severe 'important' risk due to protections which limit the attack to authenticated users.
Microsoft normally prefers to release all security updates as a single download on the second Tuesday of each month. When in-the-wild attacks occur, however, the company will sometimes release unscheduled 'out of cycle' security fixes.
Part of the risk, according to experts, comes from the dangerous nature of the vulnerability. Because it can be exploited without any user interaction, a malware infection could spread silently among millions of computers without detection.
Security firm Lumensia issued a statement urging users and administrators to update their systems as soon as possible.
"An exploit designed around this vulnerability can propagate without user interaction from machine to machine, similar to worms from years ago such as Code Red and Nimda," said the company.
"As this security update addresses a vulnerability that is currently being exploited, IT administrators should take immediate action to patch it."
Users can obtain the fix via the Microsoft Update or Windows Update components, or through the company's direct download site.
Latest stories from Security
Related articles
Related jobs
Poll
What is the most important IT priority for your company this year?
Connect with V3.co.uk
This paper focuses on a series of best practices and techniques for development teams looking to improve their software development processes
Why good data management at all levels is essential in the modern business (video, 6mins)
My client is a well established, non profit organisation;...
PHP Web Developer – £30,000 - £35,000 PHP, MySQL, HTML...
HEAD OF DIGITAL - London - £80-95K + Excellent Bens...
Agile C# Developer - (North London) £55,000 - £65,000...
Keep up to date with the latest products, services and technologies from the world's leading IT companies. IThound.com brings you over 2,000 white papers, case studies and analyst reports.
Do you agree?