US warns attackers armed to exploit Windows flaw

By Matt Whipp

Posted on 1 Aug 2003 at 16:44

'SEVERAL WORKING EXPLOITS ARE NOW IN WIDESPREAD DISTRIBUTION,' reads the DHS warning - the second in as many weeks, following the discovery of a critical hole in Microsoft's Windows operating system.

In what is an unprecedented move, the department is concerned that hackers are leaping at this vulnerability in the handling of Remote Procedure Call (RPC) messages on Windows systems as it gives 'FULL REMOTE SYSTEM LEVEL ACCESS'. This includes the ability to run arbitrary code on affected machines.

The department reports a significant increase in scanning activity for systems susceptible to exploit in this manner over the past few days. Although it fears that a worm may be being prepared that could spread with the rapacity of Code Red or Slammer using this exploit, it qualifies this by saying there have been no such reports. Yet.

The flaw affect the Windows line from NT 4.0 to Windows XP and Microsoft's most recent flagship product: Windows Server 2003.

See also:

Department of Homeland Security

Critical hole in Microsoft's Windows