Alert - Microsoft Security Advisory 958963 Released

[Dr.Melzer 191]

Microsoft weist in der gestern Nacht veröffentlichten Sicherheitsempfehlung (958963) auf die Verfügbarkeit von Angreifer-Code hin, der die in Security Bulletin MS08-067 adressierte Sicherheitsanfälligkeit im Serverdienst ausnutzt und Remotecodeausführung ermöglichen kann. Betroffen sind Systeme unter Windows 2000, Windows XP und Windows Server 2003, auf denen das in MS08-067 Microsoft Security Bulletin MS08-067*– Kritisch: Sicherheitsanfälligkeit im Serverdienst kann Remotecodeausführung ermöglichen*(958644) bereitgestellte Sicherheitsupdate noch nicht installiert wurde.

 

Weitere Infos findet Ihr unten (engl.) oder in den nächsten Tagen auf Microsoft-Sicherheitsempfehlungen - Security Advisories (dt).

 

 

What is the purpose of this alert?

 

This alert is to notify you that Microsoft has released Security Advisory 958963 – Exploit Code Published Affecting the Server Service - on October 27, 2008.

 

SUMMARY

 

Microsoft is aware that detailed exploit code demonstrating code execution has been published on the Internet for the vulnerability that is addressed by security update MS08-067. This exploit code demonstrates code execution on Windows 2000, Windows XP, and Windows Server 2003. Microsoft is aware of limited, targeted attacks that use this exploit code. At this time, there are no self-replicating attacks associated with this vulnerability. Microsoft has activated its Software Security Incident Response Process (SSIRP) and is continuing to investigate this issue.

 

Our investigation of this exploit code has verified that it does not affect customers who have installed the updates detailed in MS08-067 on their computers. Microsoft continues to recommend that customers apply the updates to the affected products by enabling the Automatic Updates feature in Windows.

 

We continue to work with our Microsoft Security Response Alliance (MSRA) and Microsoft Active Protections Program (MAPP) partners so their products can provide additional protections for customers. We have updated our Windows Live Safety Scanner, Windows Live One Care, and Forefront security products with protections for customers. We have also been working with our partners in the Global Infrastructure Alliance for Internet Safety (GIAIS) program to take steps to help keep attacks from spreading.

 

MITIGATING FACTORS

 

• Customers who have installed the MS08-067 security update are not affected by this vulnerability.

• Windows 2000, Windows XP, and Windows Server 2003 systems are primarily at risk from this vulnerability. Customers running these platforms should deploy MS08-067 as soon as possible.

• While installation of the update is the recommended action, customers who have applied the mitigations as identified in MS08-067 will have minimized their exposure and potential exploitability against an attack.

[Dr.Melzer 191]

RECOMMENDATIONS

 

Review Microsoft Security Advisory 958963 for an overview of the issue, details on affected components, mitigating factors, suggested actions, frequently asked questions (FAQ), and links to additional resources.

 

Customers who believe they are affected can contact Customer Service and Support. Contact CSS in North America for help with security update issues or viruses at no charge using the PC Safety line (866)PCSAFETY. International customers can contact Customer Service and Support by using any method found at this location: http://www.microsoft.com/protect/support/default.mspx (click on the select your region hyperlink in the first paragraph).

 

ADDITIONAL RESOURCES

 

• Microsoft Security Advisory 958963– Exploit Code Published Affecting the Server Service - Microsoft Security Advisory (958963): Exploit Code Published Affecting the Server Service

 

• Microsoft Security Bulletin MS08-067 - Vulnerability in Server Service Could Allow Remote Code Execution (958644) - Microsoft Security Bulletin MS08-067 – Critical: Vulnerability in Server Service Could Allow Remote Code Execution (958644)

 

• Microsoft Security Response Center (MSRC) Blog: The Microsoft Security Response Center (MSRC)

 

• Microsoft Malware Protection Center (MMPC) Blog: Microsoft® Malware Protection Center

 

• Security Vulnerability Research & Defense (SVRD) Blog: Security Vulnerability Research & Defense

 

• Security Development Lifecycle (SDL) Blog: The Security Development Lifecycle

 

REGARDING INFORMATION CONSISTENCY

 

We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Security Advisories posted to the web are occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in the web-based Security Advisory, the information in the web-based Security Advisory is authoritative.

 

If you have any questions regarding this alert please contact your Technical Account Manager or Application Development Consultant.

 

Thank you,

Microsoft CSS Security Team

[Dr.Melzer 191]

RECOMMENDATIONS

 

Review Microsoft Security Advisory 958963 for an overview of the issue, details on affected components, mitigating factors, suggested actions, frequently asked questions (FAQ), and links to additional resources.

 

Customers who believe they are affected can contact Customer Service and Support. Contact CSS in North America for help with security update issues or viruses at no charge using the PC Safety line (866)PCSAFETY. International customers can contact Customer Service and Support by using any method found at this location: Microsoft Security Online and Phone Support | Microsoft Security (click on the select your region hyperlink in the first paragraph).

 

ADDITIONAL RESOURCES

 

• Microsoft Security Advisory 958963– Exploit Code Published Affecting the Server Service - Microsoft Security Advisory (958963): Exploit Code Published Affecting the Server Service

 

• Microsoft Security Bulletin MS08-067 - Vulnerability in Server Service Could Allow Remote Code Execution (958644) - Microsoft Security Bulletin MS08-067 – Critical: Vulnerability in Server Service Could Allow Remote Code Execution (958644)

 

• Microsoft Security Response Center (MSRC) Blog: The Microsoft Security Response Center (MSRC)

 

• Microsoft Malware Protection Center (MMPC) Blog: Microsoft® Malware Protection Center

 

• Security Vulnerability Research & Defense (SVRD) Blog: Security Vulnerability Research & Defense

 

• Security Development Lifecycle (SDL) Blog: The Security Development Lifecycle

 

REGARDING INFORMATION CONSISTENCY

 

We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Security Advisories posted to the web are occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in the web-based Security Advisory, the information in the web-based Security Advisory is authoritative.

 

If you have any questions regarding this alert please contact your Technical Account Manager or Application Development Consultant.

 

Thank you,

Microsoft CSS Security Team