Hot Off The Net – Oct. 23, 2008 2:18PM EDT
Microsoft issued an emergency critical update today addressing a malicious Internet worm that could allow attackers to infiltrate systems remotely and take control over users’ computers without any user interaction.
The critical update is one of a handful of patches released out of sequence in the past few years. Microsoft issues regularly scheduled updates on the second Tuesday of every month, which has become known in IT circles as “Patch Tuesday.”
The fact that Microsoft has released what’s known as an “out-of-band” patch indicates the vulnerability is pretty severe.
The vulnerability, which affects almost every Windows operating system, is rated critical for multiple versions of Windows 2000, XP and Server 2003, but is given the less severe rating of “important” for Vista and Server 2008.
The error, if left unpatched, allows remote attackers to infiltrate systems in order to take control of users’ computers and steal data without any user interaction or social engineering lures. What makes this bug particularly nasty for business networks is that it has the ability to rapidly spread to other vulnerable computers within the network.
Security experts confirm that an exploit is loose in the wild, meaning that there is evidence that an attacker has already used the exploit code to conduct attacks on unsuspecting users. Microsoft also suspects that the code has been used in targeted attacks.
While Microsoft has provided possible workarounds for the vulnerability, users are advised to simply apply the patch as soon as possible. Normally we like to test these updates because you don’t want to break anything with the patch but with a critical patch such as this, it’s best to just get it installed.
Security updates are available on the Microsoft Update, Windows Update and office Update sections of the Microsoft Download Center.
As additional information becomes available, I’ll update this post.
