Gartner Questions Microsoft's Commitment To Operating-System Security
The research firm warns that the ASN.1 vulnerability made public this week could prove worse than the vulnerability that made MS Blaster possible.
Research firm Gartner issued a note late Thursday that raises serious questions about Microsoft's internal commitment to rid its operating system of security holes that make worms such as MS Blaster, SQL Slammer, and Code Red possible.
The report from Gartner was spurred by the Abstract Syntax Notation vulnerability which Microsoft made public and issued a corrective patch for earlier this week. The vulnerability affects most every modern version of the Windows operating system and most security experts agree systems that aren't quickly patched are at high risk of hacker attacks or a quick-spreading Internet worm.
"This smells like Blaster all over again," says John Pescatore, a research director at Gartner and one of the authors of the report. But Pescatore warns that this vulnerability could prove worse than the vulnerability that made MS Blaster possible. Blaster created havoc for system operators in August 2003, the same week as the major blackout that left many in the Northeast without power. The ASN.1 vulnerability can be accessed through port 80, as well as other ports widely used to communicate over the Internet.
Pescatore says April marks the one year ship date for Windows Server 2003 and he had hoped Microsoft's internal push to improve the security of its applications would have caught these types of flaws. He said it was troublesome that these types of flaws have been uncovered by external security researchers and not by Microsoft.
Eeye Digital Security was the company that found the ASN.1 vulnerability and reported it to Microsoft in July of last year. The vulnerability that MS Blaster attacked, which was within Microsoft's Distributed Component Object Model (DCOM) Remote Procedure Call interface, was discovered by The Last Stage of Delirium Research Group.
The ASN.1 vulnerability exists in versions of Windows prior to Windows 2003 Server, including Windows NT and 2000. "These old bugs being found in Windows 2003 are more worrisome than if only new bugs that only affected Windows 2003 were found," says Pescatore. "It means they've not been doing enough to find these holes on their own."
Gartner had previously recommended to its clients that they delay deployment of Windows 2003 Server in "sensitive Internet-exposed applications" until sometime after the second half of this year, but the note published Thursday indicated the firm may change its recommendation.
"We may have to revise even this cautious position if Microsoft fails to commit publicly to extraordinary efforts to eliminate glaring holes in its operating systems. Enterprises should continue to heavily weight the cost of continually patching Microsoft products when deciding which operating system to purchase," the report stated.
Gartner recommends companies immediately:
Install the Microsoft patch on all PCs and servers;
Block vulnerable ports as they are identified;
Configure enterprise firewalls correctly to limit exposure; and
Install personal firewalls on all PCs and intrusion-prevention software on all business-critical Windows servers.
In a statement E-mailed to InformationWeek, Microsoft said that it never expected to perfect security overnight, but it continues to believe that Window Server 2003 demonstrates significant progress.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Infographic: The State of DevOps in 2017Is DevOps helping organizations reduce costs and time-to-market for software releases? What's getting in the way of DevOps adoption? Find out in this InformationWeek and Interop ITX infographic on the state of DevOps in 2017.
Digital Transformation Myths & TruthsTransformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.