Microsoft issues emergency patch

Out-of-cycle update fixes serious, wormable flaw.

Microsoft

has issued an emergency update to cover a serious vulnerability in the Windows Server service, breaking its usual monthly ‘Patch Tuesday’ cycle of security fixes.

The flaw was considered serious enough to merit an urgent patch release, although

Microsoft

will only confirm having seen the usual ‘limited, targeted’ exploitation. The flaw was apparently uncovered by security researchers at

Microsoft

while investigating an extant trojan attack, and

VB

has already received several reports of such trojans taking advantage of the flaw in the Server service and file sharing.

With the nature of the flaw and the possibility of a specially targeted worm taking advantage of it to create a widespread outbreak, all users are being urged to patch as a matter of urgency. The updated October security bulletin from

Microsoft

is

here

, with blog entries from members of the security team

here

and from the

Microsoft Malware Protection Center


here

. Alex Eckleberry at the

Sunbelt

blog compares the vulnerability and its potential for exploitation with the likes of W32/SQLSlammer and W32/CodeRed,

here

.

Posted on 24 October 2008 by

Virus Bulletin