[ISN] Windows 2000 open to IP attack

[InfoSec News]

http://software.silicon.com/security/0,39024655,39151021,00.htm

By Dawn Kawamoto
4 August 2005

A serious flaw has been discovered in a core component of Windows
2000, with no possible workaround until it gets fixed, a security
company said.

The vulnerability in Microsoft's operating system could enable remote
intruders to enter a PC via its internet protocol address, Marc
Maiffret, chief hacking officer at eEye Digital Security, said on
Wednesday. As no action on the part of the computer user is required,
the flaw could easily be exploited to create a worm attack, he noted.

What may be particularly problematic with this unpatched security hole
is that a workaround is unlikely, he said.

"You can't turn this [vulnerable] component off," Maiffret said. "It's
always on. You can't disable it. You can't uninstall."

eEye declined to give more details on the flaw or the Windows 2000
component in question. As part of company policy, it does not release
technical details of the vulnerabilities it finds until the software's
maker has released either a patch or an advisory.

A Microsoft representative said the software giant will issue a
comment once it has had a chance to review the eEye advisory, which
has yet to be posted on the security company's website.

The vulnerabilities affect Windows 2000 but Maiffret noted eEye is
still conducting tests, and he anticipates other versions of
Microsoft's OS are likely to be affected.

For Microsoft, this marks the second eEye advisory it's received this
week. On Monday, eEye notified the software giant it had found
critical vulnerabilities in Internet Explorer.

The IE vulnerabilities could allow malicious attackers to launch a
remote buffer overflow attack should users click on a malicious
website link.

The flaw, which is rated as "high" risk, affects IE, Windows XP and
SP1, Windows 2003 and Windows 2000.

Microsoft confirmed it received the eEye advisory regarding IE through
its standard vulnerability reporting system.

A Microsoft representative said: "We are investigating the report and
will take appropriate action to help protect customers as part of our
normal security response process." Microsoft issues a monthly bulletin
of patches and also has a programme of security advisories with
workarounds for unpatched, reported flaws.