Menu
MS changes tune, says attackers are exploiting new bug

MS changes tune, says attackers are exploiting new bug

Initially Microsoft said there were no attacks based on the MS09-051 issue

One of the 34 bugs Microsoft patched on Tuesday is more serious than it first appeared.

Two hours after initially reporting in its security bulletin (MS09-051) that it was unaware of attacks exploiting a multimedia flaw in the Windows Media Runtime software, Microsoft revised its assessment. The software vendor now says that its initial bulletin was wrong and it has in fact seen "limited attacks trying to use the reported vulnerability."

The flaw lies in the way the Windows Media Runtime software processes certain types of ASF (Advanced Systems Format) files, used by streaming media. Microsoft rates the issue as critical for Windows 2000, XP, Vista and Windows Server users.

It was initially reported to Microsoft by both McAfee and 3Com's TippingPoint unit.

A McAfee spokesman echoed Microsoft's assessment of the bug Tuesday. "We have not seen any extensive in-the-wild exploitation of this vulnerability," said Joris Evers, via instant message.

Although the bug had been publicly disclosed, it was not widely known in the security research community.

McAfee's Evers said that one of his company's researchers had stumbled across the bug in a Chinese language bulletin board.

Tuesday's patch release was Microsoft's largest ever, fixing 34 bugs in the company's software, including vulnerabilities in the SMB (Server Message Block) 2 software that Microsoft introduced in Vista and the FTP (File Transfer Protocol) service that ships with some versions of the IIS (Internet Information Services) Web server. These two bugs had also been publicly disclosed, although neither is being used in any kind of widespread attack, security experts say.

Administrators should install the Windows Media Runtime patch as soon as possible, because this type of flaw could easily be exploited in a Web-based attack, said Andrew Storms, director of security operations with nCircle. "You can embed malicious code in what looks like a normal audio file," he said.


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Tags Microsofthotmail

Featured

Slideshows

Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Show Comments