Microsoft RPC exploit could be a packaged deal

While Microsoft has labeled Thursday's emergency patch MS08-067 as "critical" and provided a rareout-of-cycle fix because its exploit could easily be used as worm on a compromised network, one security researcher doesn't th nike air max 90 white ink it will happen that way.

"It's likely we're going to see this packaged with some other attack." said Ben Greenbaum, senior research manager at Symantec. "A Web-based attack nike air max 90 current , for example. We're looking out for are exploits of this being bundled with client-side exploits or Trojans so that the worm can get past corporate firewalls and get behind that fir huarache low ewall into the internal network."

Comparisons have been made to Zotob, an RPC worm that spread like wildfire in 2005. Remote Procedure Calls (RPC) allows programmers to run code e air max 2010 ither locally or remotely; a flaw within them is ideal for creating a worm.

"The potential is certainly there," Greenbaum said, adding that modern day attackers are "looking to create as much revenue for themse custom nike air max lves as possible, and part of that equation means avoiding detection. What we're likely to see is that this will be added to a wide variety of attack tool kits already available."

"It's possible--but it' nike air max huarache s not likely--that we'll end up seeing a purpose-built worm that only exploits this one vulnerability," he said.

Since the patch came out Thursday morning, Symantec has s nike air max 2010 een increased scanning on ports 139 and 445, ports that exploits of MS08-067 would use.

There are some mitigating factors. Most firewalls, with default settings in place, should not allow an exploit of thi jordan huarache s penetrate that firewall, he said. However, home networks with File and Printer Sharing could fall victim to a bundled attack using this exploit.

The greatest danger is to sys air max shoes tems running Windows XP and Windows 2000; Microsoft has ranked the patch as critical for these systems. On Windows Vista, Windows Server 2008, or Windows 7 pre-Beta, if the firewall is disabled, and File and Printer s men huarache haring enabled, an anonymous user could use this exploit to connect but would do so only at the lowest possible integrity setting, which would prevent successful exploitation, Greenbaum s buy air max shoes aid. Microsoft has rated the patch only as important for those operating systems.

As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to sh 

 are his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your ques 

 tions and comments. Topics: News, Vulnerabilities & attacks Tags: security, Microsoft, MS08-067, Ben Greenbaum, Symantec, File and Printer Sharing, RPC, exploit, worm, ports 139, port 445 Share: Digg Del.icio.us Reddit Facebook Twitter