Microsoft Schannel Vulnerabilty – Patch It NOW


So yah, it seems like every implementation of TLS is broken and some may say this Microsoft Schannel vulnerabilty is actually worse than Heartbleed. Why is it worse you ask? Because it allows remote code execution, which honestly – is about as bad as it gets.

Microsoft Schannel Vulnerabilty

This is a critical update, a really, really critical patch that must be applied ASAP to all Windows machines. Fortunately there doesn’t seem to be a live exploit in the wild being used, but that doesn’t mean someone doesn’t have one.

Patch Tuesday this month is a genuinely huge (and rather important) set of updates.

Microsoft has been forced to issue a critical patch for a vulnerability that affects every current version of its Windows operating system.

The bug affects code in the Microsoft secure channel (schannel) security component. This component implements the secure sockets layer and transport layer security (TLS) protocols.

A flaw in the code means it fails to properly filter specially formed packets allowing hackers to execute code remotely on an affected Windows machine.

According to the advisory, the flaw affects Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 8/8.1, Windows Server 2012/2012 R2, and Windows RT/RT 8.1 machines. The flaw is rated critical for all affected operating systems.

Microsoft said that it “had not received any information to indicate that this vulnerability had been publicly used to attack customers”.


This could potentially wreak havoc if someone codes it into a worm or mass botnet exploit which self replicates, as I imagine we have about a week or so before a live exploit is reverse engineered from the patch.

And then boom, anyone who hasn’t patched (which unfortunately, as we know is going be a lot of people) is going to get popped.

You can read the actual Microsoft Bulletin (MS14-066) here – Vulnerability in Schannel Could Allow Remote Code Execution (2992611)

Security researchers said exploitation of the SChannel bug has the potential to be worse than Heartbleed and Shellshock combined due to the large numbers of affected systems.

“Heartbleed was less powerful because it was ‘just’ an information disclosure bug and Shellshock was remotely exploitable only in a subset of affected systems,” said Craig Young, security researcher at Tripwire.

“Some administrators may want to prioritise this over the Internet Explorer patch even though we’ve seen attacks we’ve seen in the wild against the browser. This is because MS14-066 has the potential to be exploited without user-interaction,” he said.

Young added that exploitation of the bug would be “tricky”. “Hopefully, this will give admins enough time to patch their systems before we see exploits.”

Just last week, Microsoft was preparing a slew of updates to its products with 16 patches to fix critical flaws in Windows and Internet Explorer.

It seems from some sources too that it’s not just one vulnerability, but a whole set which has been mentioned by Cisco/Talos here:

Microsoft Update Tuesday November 2014: Fixes for 3 0-day Vulnerabilities

It seems like it was internally found during a proactive security assessment, which is a good sign and means a more secure Microsoft environment for us in the future. We shall have to keep a close eye on this and see if the Windows World explodes.

Source: ITPro

Posted in: Cryptography, Exploits/Vulnerabilities, Windows Hacking

, , ,


Latest Posts:


RandIP - Network Mapper To Find Servers RandIP – Network Mapper To Find Servers
RandIP is a nim-based network mapper application that generates random IP addresses and uses sockets to test whether the connection is valid or not with additional tests for Telnet and SSH.
Nipe - Make Tor Default Gateway For Network Nipe – Make Tor Default Gateway For Network
Nipe is a Perl script to make Tor default gateway for network, this script enables you to directly route all your traffic from your computer to the Tor network.
Mosca - Manual Static Analysis Tool To Find Bugs Mosca – Manual Static Analysis Tool To Find Bugs
Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
Slurp - Amazon AWS S3 Bucket Enumerator Slurp – Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan externally or an AWS API to scan internally.
US Government Cyber Security Still Inadequate US Government Cyber Security Still Inadequate
Surprise, surprise, surprise - an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.
BloodHound - Hacking Active Directory Trust Relationships BloodHound – Hacking Active Directory Trust Relationships
BloodHound is for hacking active directory trust relationships and it uses graph theory to reveal the hidden and often unintended relationships within an AD environment.


Comments are closed.