{"id":3824,"date":"2014-11-13T02:20:54","date_gmt":"2014-11-12T18:20:54","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3824"},"modified":"2015-09-09T19:36:43","modified_gmt":"2015-09-09T11:36:43","slug":"microsoft-schannel-vulnerabilty-patch-now","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2014\/11\/microsoft-schannel-vulnerabilty-patch-now\/","title":{"rendered":"Microsoft Schannel Vulnerabilty &#8211; Patch It NOW"},"content":{"rendered":"<p>So yah, it seems like every implementation of TLS is broken and some may say this Microsoft Schannel vulnerabilty is actually worse than <a href=\"https:\/\/www.darknet.org.uk\/2014\/04\/heartbleed-bug-ssl-vulnerability-everything-need-know\/\">Heartbleed<\/a>. Why is it worse you ask? Because it allows remote code execution, which honestly &#8211; is about as bad as it gets.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/farm9.staticflickr.com\/8121\/15589266217_1d4ccf490e.jpg\" alt=\"Microsoft Schannel Vulnerabilty\" \/><\/p>\n<p>This is a critical update, a really, really critical patch that must be applied ASAP to all Windows machines. Fortunately there doesn&#8217;t seem to be a live exploit in the wild being used, but that doesn&#8217;t mean someone doesn&#8217;t have one.<\/p>\n<p>Patch Tuesday this month is a genuinely huge (and rather important) set of updates. <\/p>\n<blockquote><p>Microsoft has been forced to issue a critical patch for a vulnerability that affects every current version of its Windows operating system.<\/p>\n<p>The bug affects code in the Microsoft secure channel (schannel) security component. This component implements the secure sockets layer and transport layer security (TLS) protocols.<\/p>\n<p>A flaw in the code means it fails to properly filter specially formed packets allowing hackers to execute code remotely on an affected Windows machine.<\/p>\n<p>According to the advisory, the flaw affects Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 8\/8.1, Windows Server 2012\/2012 R2, and Windows RT\/RT 8.1 machines. The flaw is rated critical for all affected operating systems. <\/p>\n<p>Microsoft said that it \u201chad not received any information to indicate that this vulnerability had been publicly used to attack customers\u201d. <\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>This could potentially wreak havoc if someone codes it into a worm or mass botnet exploit which self replicates, as I imagine we have about a week or so before a live exploit is reverse engineered from the patch. <\/p>\n<p>And then boom, anyone who hasn&#8217;t patched (which unfortunately, as we know is going be a lot of people) is going to get popped.<\/p>\n<p>You can read the actual Microsoft Bulletin (MS14-066) here &#8211; <a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/security\/MS14-066\">Vulnerability in Schannel Could Allow Remote Code Execution (2992611)<\/a><\/p>\n<blockquote><p>Security researchers said exploitation of the SChannel bug has the potential to be worse than Heartbleed and Shellshock combined due to the large numbers of affected systems. <\/p>\n<p>\u201cHeartbleed was less powerful because it was \u2018just\u2019 an information disclosure bug and Shellshock was remotely exploitable only in a subset of affected systems,\u201d said Craig Young, security researcher at Tripwire.<\/p>\n<p>\u201cSome administrators may want to prioritise this over the Internet Explorer patch even though we\u2019ve seen attacks we\u2019ve seen in the wild against the browser. This is because MS14-066 has the potential to be exploited without user-interaction,\u201d he said. <\/p>\n<p>Young added that exploitation of the bug would be \u201ctricky\u201d. \u201cHopefully, this will give admins enough time to patch their systems before we see exploits.\u201d<\/p>\n<p>Just last week, Microsoft was preparing a slew of updates to its products with 16 patches to fix critical flaws in Windows and Internet Explorer.<\/p><\/blockquote>\n<p>It seems from some sources too that it&#8217;s not just one vulnerability, but a whole set which has been mentioned by Cisco\/Talos here:<\/p>\n<p><a href=\"http:\/\/blogs.cisco.com\/security\/talos\/ms-tuesday-nov-2014\">Microsoft Update Tuesday November 2014: Fixes for 3 0-day Vulnerabilities<\/a><\/p>\n<p>It seems like it was internally found during a proactive security assessment, which is a good sign and means a more secure Microsoft environment for us in the future. We shall have to keep a close eye on this and see if the Windows World explodes.<\/p>\n<p><strong>Source:<\/strong> <a href=\"http:\/\/www.itpro.co.uk\/security\/23493\/microsoft-rushes-to-patch-critical-flaw-affecting-every-windows-pc\">ITPro<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>So yah, it seems like every implementation of TLS is broken and some may say this Microsoft Schannel vulnerabilty is actually worse than Heartbleed. Why is it worse you ask? Because it allows remote code execution, which honestly &#8211; is about as bad as it gets. This is a critical update, a really, really critical [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"So yah, it seems like every implementation of TLS is broken and some may say this Microsoft Schannel vulnerabilty is actually worse than Heartbleed.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[26,10,4],"tags":[548,134,1430,492],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3824"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3824"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3824\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3824"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3824"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}