Microsoft Schannel Vulnerabilty – Patch It NOW


So yah, it seems like every implementation of TLS is broken and some may say this Microsoft Schannel vulnerabilty is actually worse than Heartbleed. Why is it worse you ask? Because it allows remote code execution, which honestly – is about as bad as it gets.

Microsoft Schannel Vulnerabilty

This is a critical update, a really, really critical patch that must be applied ASAP to all Windows machines. Fortunately there doesn’t seem to be a live exploit in the wild being used, but that doesn’t mean someone doesn’t have one.

Patch Tuesday this month is a genuinely huge (and rather important) set of updates.

Microsoft has been forced to issue a critical patch for a vulnerability that affects every current version of its Windows operating system.

The bug affects code in the Microsoft secure channel (schannel) security component. This component implements the secure sockets layer and transport layer security (TLS) protocols.

A flaw in the code means it fails to properly filter specially formed packets allowing hackers to execute code remotely on an affected Windows machine.

According to the advisory, the flaw affects Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 8/8.1, Windows Server 2012/2012 R2, and Windows RT/RT 8.1 machines. The flaw is rated critical for all affected operating systems.

Microsoft said that it “had not received any information to indicate that this vulnerability had been publicly used to attack customers”.


This could potentially wreak havoc if someone codes it into a worm or mass botnet exploit which self replicates, as I imagine we have about a week or so before a live exploit is reverse engineered from the patch.

And then boom, anyone who hasn’t patched (which unfortunately, as we know is going be a lot of people) is going to get popped.

You can read the actual Microsoft Bulletin (MS14-066) here – Vulnerability in Schannel Could Allow Remote Code Execution (2992611)

Security researchers said exploitation of the SChannel bug has the potential to be worse than Heartbleed and Shellshock combined due to the large numbers of affected systems.

“Heartbleed was less powerful because it was ‘just’ an information disclosure bug and Shellshock was remotely exploitable only in a subset of affected systems,” said Craig Young, security researcher at Tripwire.

“Some administrators may want to prioritise this over the Internet Explorer patch even though we’ve seen attacks we’ve seen in the wild against the browser. This is because MS14-066 has the potential to be exploited without user-interaction,” he said.

Young added that exploitation of the bug would be “tricky”. “Hopefully, this will give admins enough time to patch their systems before we see exploits.”

Just last week, Microsoft was preparing a slew of updates to its products with 16 patches to fix critical flaws in Windows and Internet Explorer.

It seems from some sources too that it’s not just one vulnerability, but a whole set which has been mentioned by Cisco/Talos here:

Microsoft Update Tuesday November 2014: Fixes for 3 0-day Vulnerabilities

It seems like it was internally found during a proactive security assessment, which is a good sign and means a more secure Microsoft environment for us in the future. We shall have to keep a close eye on this and see if the Windows World explodes.

Source: ITPro

Posted in: Cryptography, Exploits/Vulnerabilities, Windows Hacking

, , ,


Latest Posts:


Sandcastle - AWS S3 Bucket Enumeration Tool Sandcastle – AWS S3 Bucket Enumeration Tool
Astra - API Automated Security Testing For REST Astra – API Automated Security Testing For REST
Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs.
Judas DNS - Nameserver DNS Poisoning Attack Tool Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.
dsniff Download - Tools for Network Auditing & Password Sniffing dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network
OWASP Amass - DNS Enumeration, Attack Surface Mapping & External Asset Discovery OWASP Amass – DNS Enumeration, Attack Surface Mapping & External Asset Discovery
The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping & External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces.
Cameradar - Hack RTSP Video Surveillance CCTV Cameras Cameradar – Hack RTSP Video Surveillance CCTV Cameras
Cameradar is a Go-based tool to hack RTSP Video Surveillance CCTV Cameras, it can detect open RTSP hosts, detect device models and launch automated attacks.


Comments are closed.