Recent maakte Microsoft bekend dat het bedrijf opnieuw een aantal 'critical severity' gaten in de Windows software heeft gevonden. Deze gaten zijn vergelijkbaar met het reeds bekende gat dat door de Blaster worm werd uitgebuit.
In de bijgesloten media advisory treft u meer informatie over de gevolgen voor de beveiliging van Windows systemen en de stappen die McAfee gebruikers kunnen nemen om zich proactief te beschermen tegen eventuele toekomstige virussen die deze zwakheden kunnen gebruiken om schade aan te richten.
Voor meer informatie over de gaten in Windows en de McAfee technologie die bedrijven kunnen inzetten om zich te wapenen tegen dergelijke zwakheden in hun systeem kunt u ook spreken met een expert van McAfee AVERT, het Anti Virus Emergency Response Team van Network Associates, dat vanuit verschillende centra wereldwijd de verspreiding en technologie van nieuwe virussen onderzoekt.
-- MEDIA ADVISORY --
Media Advisory: Network Associates(R) Protects Against New Microsoft Vulnerabilities Disclosed Today
Newly Disclosed Microsoft Windows RPC Vulnerabilities Can Allow Potential Buffer Overflow and Cause Denial of Service Attacks
McAfee(R) Protection-In-Depth(TM) Strategy Provides Complete System and Network Protection Can Identify and Block Attacks
SANTA CLARA, 10 september 2003 -- Microsoft(R) published an advisory today regarding two newly discovered "critical severity" vulnerabilities present in the Windows(R) Remote Procedure Call (RPC) service. These two new vulnerabilities are in addition to the RPC Buffer Overflow vulnerability announced by Microsoft on July 16. These new vulnerabilities are very similar to the Microsoft vulnerability exploited by the LovSan/Nachi worms. The first of the vulnerabilities could allow a buffer overflow to enable hackers to execute arbitrary code; the second could result in a Denial of Service (DoS) attack. Network Associates, Inc. (NYSE: NET), the leading provider of intrusion prevention solutions, has a comprehensive suite of system and network protection solutions to fully protect from the newest RPC vulnerabilities disclosed by Microsoft today.
Network Associates(R) McAfee(R) Protection-In-Depth(TM) strategy provides complete system and network protection for these vulnerabilities with its McAfee IntruShield(R), McAfee Entercept(R) and Sniffer(R) Technologies solutions. Network Associates is recommending that users deploy these technologies to identify and block attempts to exploit these vulnerabilities.
Network Associates offers multiple layers of protection, including:
• McAfee Entercept solutions stop attacks against both the old and new Microsoft RPC buffer overflow vulnerability because of its first and only patented buffer overflow technology.
• McAfee IntruShield stops all three Microsoft RPC vulnerabilities enabling companies to be safe now without having to rush to patch all of their vulnerable systems.
• Sniffer Technologies filters can be used to alert managers to the presence of the malicious traffic used to exploit the Microsoft RPC buffer overflow vulnerability.
• InfiniStream(TM) Security Forensics can be used to mine and reconstruct attempts to exploit these vulnerabilities.
• Magic Solutions(R) is a remediation management that enables service desk teams to prioritize and assign the process of updating critical network servers.
Network Associates McAfee Protection-in-Depth Strategy delivers the industry's only complete set of system and network protection solutions differentiated by intrusion prevention technology that can detect and block attempts to attack these and other vulnerabilities.
Microsoft RPC Buffer Overflow and DoS Vulnerabilities Microsoft today published an advisory regarding a buffer overflow and DoS vulnerability in the Windows RPC service. The RPC service provides remote procedure calls between objects executing on two remote machines running the Windows operating system.
Scope
An attacker can exploit these vulnerabilities by crafting a packet and sending it to a vulnerable server. Doing so would either allow the attacker to execute code on the victim machine (buffer overflow vulnerability), or to cause the victim machine to crash and restart (DoS vulnerability).
A malicious attacker may use the buffer overflow vulnerability to execute code on the victim machine, gaining Local System privileges on an affected system. This allows the potential to install programs, view, change or delete data, or create new accounts with full privileges.
Versions Affected:
• Windows NT 4.0 Server (buffer overflow vulnerability only)
• Window NT 4.0, Terminal Server Edition (buffer overflow vulnerability only)
• Windows 2000 (buffer overflow and DoS vulnerabilities)
• Windows XP (buffer overflow vulnerability only)
• Windows Server(TM) 2003 (buffer overflow vulnerability only)
Solution
McAfee Entercept provides patented protection against code execution as a result of buffer overflows, including the Microsoft RPC vulnerability. McAfee Entercept will prevent attack code from being executed from writable memory as a result of a buffer overrun, protecting the integrity of the server. This protection functions whether or not the server has the latest security patch installed.
McAfee Entercept and its patented solution safeguards servers against all types of buffer overflows, without any signature or code updates.
McAfee IntruShield users with 1.5.11.4 signature set or later will receive alerts on attacks exploiting this vulnerability. McAfee IntruShield sensors deployed in in-line mode can be configured with a response action to drop such packets for preventing these attacks.
The Sniffer Technologies engineering team has created filters that enable customers with Sniffer Portable and Sniffer Distributed to detect if attempts are being made to exploit the Microsoft RPC vulnerabilities. Additionally, customers can use Sniffer Distributed and InfiniStream Security Forensics to monitor the network, from the edge to the core, to detect events that may trigger these vulnerabilities.
Network Associates recommends that users affected by the Microsoft RPC vulnerabilities deploy the necessary patches and adhere to Microsoft's security recommendations. Users affected by this specific Microsoft vulnerability should update their systems with Microsoft patch available on the Microsoft web site and restart the server.
Information on the Network Associates technologies to provide complete system and network protection can be found online at the Network Associates site located at http://www.networkassociates.com.
McAfee System Protection Solutions
McAfee System Protection Solutions secure all layers of desktop and server systems and applications. Best-of-breed system protection solutions in the portfolio include McAfee anti-virus, McAfee ThreatScan for viral vulnerability assessment, McAfee Entercept preventing system intrusions, and McAfee SpamKiller to block unsolicited e-mail. These products are all centrally managed by the company's industry leading McAfee ePolicy Orchestrator (ePO) which delivers policy management and reporting of both McAfee and third-party security products. Also in the McAfee System Protection Solutions portfolio is the Magic Service Desk family of products offering management and visibility of desktop and server systems.
McAfee Network Protection Solutions
McAfee Network Protection Solutions keep both large and smaller distributed networks up and protected from attacks. Best-of-breed network protection solutions in the portfolio include the Sniffer Network Protection Platform for performance management and fault identification, InfiniStream performing security forensics on network activity, Network Performance Orchestrator (nPO) for centralizing and managing network activity, and McAfee IntruShield delivering network-based intrusion prevention.
About Network Associates
With headquarters in Santa Clara, Calif., Network Associates, Inc. (NYSE: NET) creates best-of-breed computer security solutions that prevent intrusions on networks and protect computer systems from the next generation of blended attacks and threats. Offering two families of products, McAfee System Protection Solutions, securing desktops and servers, and McAfee Network Protection Solutions, ensuring the protection and performance of the corporate network, Network Associates offers computer security to large enterprises, governments, small and medium sized businesses, and consumers. These two product portfolios incorporate Network Associates leading McAfee, Sniffer andMagic Solutions(R) product lines. For more information, Network Associates can be reached at 972-963-8000 or on the Internet at http://www.networkassociates.com/ .
NOTE: Network Associates, McAfee, Sniffer, Magic Solutions, IntruShield, Entercept, and InfiniStream are registered trademarks or trademarks of Network Associates, Inc. and/or its affiliates in the United States and/or other countries. Sniffer(R) brand products are made only by Network Associates, Inc.
All other registered and unregistered trademarks herein are the sole property of their respective owners.