Microsoft admits hackers are attacking critical bug
Largest ever patch fixes security flaw already under attack in the wild
By Robert McMillan | Published: 10:24, 14 October 2009
Microsoft has patched a record number of security holes in its Windows operating systems and other software, and admitted that at least one of the 34 security flaws was already under attack.
Two hours after initially reporting in its security bulletin (MS09-051) that it was unaware of attacks exploiting a multimedia flaw in the Windows Media Runtime software, Microsoft revised its assessment. The software vendor now says that its initial bulletin was wrong and it has in fact seen "limited attacks trying to use the reported vulnerability."
The flaw lies in the way the Windows Media Runtime software processes certain types of Advanced Systems Format (ASF) files, used by streaming media. Microsoft rates the issue as critical for Windows 2000, XP, Vista and Windows Server users.
Related Articles on Techworld
It was initially reported to Microsoft by both McAfee and 3Com's TippingPoint unit.
A McAfee spokesman echoed Microsoft's assessment of the bug Tuesday. "We have not seen any extensive in-the-wild exploitation of this vulnerability," said Joris Evers, via instant message.
Although the bug had been publicly disclosed, it was not widely known in the security research community.
McAfee's Evers said that one of his company's researchers had stumbled across the bug in a Chinese language bulletin board.
Tuesday's patch release was Microsoft's largest ever, fixing 34 bugs in the company's software, including vulnerabilities in the SMB 2 (Server Message Block) software that Microsoft introduced in Vista and the File Transfer Protocol (FTP) service that ships with some versions of the Internet Information Services (IIS) web server. These two bugs had also been publicly disclosed, although neither is being used in any kind of widespread attack, security experts say.
Administrators should install the Windows Media Runtime patch as soon as possible, because this type of flaw could easily be exploited in a Web-based attack, said Andrew Storms, director of security operations with nCircle. "You can embed malicious code in what looks like a normal audio file," he said.
