News

Microsoft.com Outage Not the Start of Widespread RPC Exploits

• By Scott Bekker
• August 04, 2003

Microsoft hastened to reassure the security and user community that a denial-of-service attack that took down the Microsoft.com Web site for an hour and forty minutes on Friday was not evidence of the beginning of widespread attacks based on a recent flaw in Windows.

"This attack does not have any association with any known vulnerabilities in Microsoft software," a statement posted by the software giant on Friday reads. Microsoft blamed the outage on a run-of-the-mill attack where attackers cause a malicious flood of requests to hit a site and overwhelm server capacity. "Microsoft has contacted the appropriate authorities, is cooperating in the investigation of the cause of this attack, and will take appropriate action," the company said.

The outage raised eyebrows on Friday as the IT community awaits fallout from a security vulnerability that Microsoft patched on July 16. Chinese and U.S. coders released exploit code more than a week ago that takes advantage of the flaw explained and patched in bulletin MS03-026.

Microsoft has e-mailed and posted on its site unusually urgent warnings for users to patch the flaw, which affects Windows Server 2003, Windows 2000, Windows NT 4.0 and Windows XP. A buffer overrun vulnerability in the Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) interface could allow a malicious user to take control of a user's computer over the Internet. Increased scanning of affected ports has already been detected, although a widespread worm exploiting the problem has not yet hit the Web. Security researchers at CERT/CC, however, have also warned that even patched systems remain exposed to a less serious denial-of-service attack.

Microsoft declined to specify the RPC vulnerability as the reason for posting the notice about the cause of the Web site outage.

The Microsoft patch is available here:
www.microsoft.com/technet/security/bulletin/MS03-026.asp.