Microsoft fixed a critical vulnerability Tuesday in the Windows cryptographic library that could expose Windows servers to remote code execution attacks. The update also adds support for stronger and more modern cryptographic ciphers to older Windows versions.
“The vulnerability could allow remote code execution if an attacker sends specially crafted packets to a Windows server,” Microsoft’s said in a security bulletin called MS14-066. However, the flaw is in the Microsoft Secure Channel (SChannel) component that exists in all Windows versions and implements the SSL and TLS cryptographic protocols.
The Microsoft security bulletin makes it clear that an attacker could exploit the vulnerability – dubbed WinShock – to execute arbitrary code on a Windows system running as a server. However, it’s not as clear whether a malicious HTTPS website could exploit the vulnerability to execute code on a Windows computer when a user visits the site in Internet Explorer, which relies on SChannel for SSL/TLS connections.
A separate Microsoft blog post about assessing the risk for the November security updates suggests that this might be possible. It contains a table that lists the most likely attack vector for MS14-066 as “user browses to a malicious webpage.”
“The vulnerability bulletin provided calls out servers as the potential victims, but the SSL/TLS stack is used every time your browser connects to a secure website (which most are these days),” said Jared DeMott, a security researcher at Bromium, via e-mail. “And it would be straightforward for an attacker with details of this vulnerability, to host a malicious site that offers ‘security’ via the bogus SSL/TLS packets. Could a malicious website exploit IE with this bug? Until someone reverse engineers the patch, we’ll have to wait to hear about how bad it is.”
Better support
This critical SChannel flaw comes after serious vulnerabilities were found this year in other widely used SSL/TLS libraries, including OpenSSL, GnuTLS and the TLS library used by Apple in Mac OS X and iOS.
But the update described in MS14-066 doesn’t only address a security vulnerability. It also adds support for stronger encryption ciphers on older Windows versions.
Subscribers 0
Fans 0
Followers 0
Followers