UPDATED 05:51 EDT / FEBRUARY 12 2015

Microsoft patches lingering bug that affects all versions of Windows NEWS

Microsoft patches lingering bug that affects all versions of Windows

JasburgMicrosoft has announced that it has taken care of a bug that may have been around for some 15 years, and could have put millions of PC users running all version of Windows at risk of giving attackers complete control of their machine.

The vulnerability, codenamed Jasburg, which Microsoft says took a year to clean-up, still remains a critical vulnerability in Windows Server 2003, although the Redmond company has suggested that users update their operating system as an upgrade would jeopardize system stability and cause application compatibility problems. If an attacker were to be successful they could “install programs; view, change, or delete data; or create new accounts with full user rights,” Microsoft reported.

The bug, which was discovered by JAS Global Advisors, a security company based in Chicago IL, could affect users connected to a corporate, business Active Directory network by allowing an attacker to act as a man-in-the-middle between user and network, enabling the attacker to exploit a vulnerable machine. Roaming computers connected to public Wi-Fi are at “heightened risk”, JAS said in a statement. Microsoft also gave an example as a “risk scenario” of users being attacked while using public Wi-Fi in a coffee shop.

The reason the fix took so long to implement was due to it being an unusual, or “unprecedented” vulnerability, in that, “Unlike recent high-profile vulnerabilities like Heartbleed, Shellshock, Gotofail, and POODLE, this is a design problem not an implementation problem. The fix required Microsoft to re-engineer core components of the operating system and to add several new features,” wrote JAS. The company added that rigorous attention had to be paid to backwards compatibility, and regression testing by Microsoft had to be performed to lesson side-effects of the fix. A “fix it right” policy, rather than a perhaps not so successful “fix it fast” procedure was said to be embraced by Microsoft.

Because of the profound nature of the flaw and new features that need to be configured on Active Directory Clients and Servers, IT professionals working in Microsoft environments have been advised to “move rapidly” and seek support. An overview of the vulnerability is available here.

Photo credit: Microsoft Jasburg scenario


A message from John Furrier, co-founder of SiliconANGLE:

Support our open free content by sharing and engaging with our content and community.

Join theCUBE Alumni Trust Network

Where Technology Leaders Connect, Share Intelligence & Create Opportunities

11.4k+  
CUBE Alumni Network
C-level and Technical
Domain Experts
15M+ 
theCUBE
Viewers
Connect with 11,413+ industry leaders from our network of tech and business leaders forming a unique trusted network effect.

SiliconANGLE Media is a recognized leader in digital media innovation serving innovative audiences and brands, bringing together cutting-edge technology, influential content, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — such as those established in Silicon Valley and the New York Stock Exchange (NYSE) — SiliconANGLE Media operates at the intersection of media, technology, and AI. .

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a powerful ecosystem of industry-leading digital media brands, with a reach of 15+ million elite tech professionals. The company’s new, proprietary theCUBE AI Video cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.