Microsoft Confirms First Windows 7 Zero-Day Bug

[RoyGBiv]

By Gregg Keizer Framingham | Monday, 16 November, 2009

Microsoft late has confirmed that an unpatched vulnerability exists in Windows 7, but is downplaying the problem, saying most users would be protected from attack by blocking two ports at the firewall.

In a security advisory, Microsoft acknowledged that a bug in SMB (Server Message Block), a Microsoft-made network file- and print-sharing protocol, could be used by attackers to cripple Windows 7 and Windows Server 2008 R2 machines.

The zero-day vulnerability was first reported by Canadian researcher Laurent Gaffie last Wednesday, when he revealed the bug and posted proof-of-concept attack code to the Full Disclosure security mailing list and his blog. According to Gaffie, exploiting the flaw crashes Windows 7 and Server 2008 R2 systems so thoroughly that the only recourse is to manually power off the computers.

...

Microsoft said it may patch the problem, but didn't spell out a timetable or commit to an out-of-cycle update before the next regularly-scheduled Patch Tuesday of December 8. Instead, the company suggested users block TCP ports 139 and 445 at the firewall. Doing so, however, would disable a host of critical services, including network file-sharing and IT group policies.

http://computerworld.co.nz/news.nsf/scrt/E9592E1A9719742ACC25766F0066B38D

As a Slashdot wonk observed, this block needs to be on *outgoing* traffic, not incoming.

[canetoad]

1. An amazingly gracious post Roy

I would have gone :rofl::rofl::rofl::rofl: but you just quietly stated the facts. (Didya hear about the NetBios packets?)

Those who do not learn from history are doomed to repeat it. Give Windows 7 at least 6, 8 or 10 months to be sorted out, patched and service-packed and then consider installing it.

[RoyGBiv]

2. Yes, well ...

Delayed gratification isn't in our culture. Immediate frustration is.

And, Microsoft has done such a good job of convincing the public that it's a privilege to be a Beta tester that I know I'm just spitting into the wind to try to change minds at this stage.

It's like I said in Linux thread recently (and have said before). Except with certain software I know intimately, I don't update to the latest and greatest until it has been out in the wild awhile. Issues always arise, no matter the platform, and I prefer to let those brave souls who don't mind navigating that jungle find out what the major ones are before I take the plunge.

There's nothing worse than spending days or weeks customizing and hardening the security on a system only to find out there's an inherent flaw in some component of it that either undoes everything or makes irrelevant everything I did. I've been avoiding Karmic Koala, and have avoided all non-Long Term Support (LTS) releases, for this reason. Sure enough, a few issues are starting to arise with Ubuntu's latest release ... no show stoppers yet, but ya never know.