With the high-tech world still reeling from the Slammer worm, Microsoft ironically has been forced to pull one of its security patches because it actually introduces an error that may cause systems to fail.
While the Slammer worm inflicted its damage on copies of Microsoft SQL Server 2000, the latest problem revolves around a security patch for Windows NT 4.0 systems. But it comes at a time when sysadmins are being scolded for not updating systems with the necessary patches in the first place. (The patch for Slammer has been around since July.)
Security officials at Microsoft withdrew the patch and removed download
links for the flaw, which was first issued
on December 11. The security vulnerability was found in the WM_TIMER
Message Handling in NT 4.0 and could enable privilege elevation.
Patches for Windows 2000 and Windows XP were unaffected by the latest
withdrawal, Microsoft said.
In the updated advisory, Microsoft said it was
investigating the cause of the problematic patch and promised to release an
updated fix soon.
The company urged Windows NT 4.0 administrators to uninstall the patch
until a new fix is issued.
The vulnerability affects the way Windows messages run interactive
processes to react to user events like keystrokes or mouse movements and
communicate with other interactive processes. One such
event,WM_TIMER, is sent at the expiration of a timer and can be used
to cause a process to execute a timer callback function.
“A security vulnerability results because it’s possible for one process
in the interactive desktop to use a WM_TIMER message to cause another
process to execute a callback function at the address of its choice, even if
the second process did not set a timer. If that second process had higher
privileges than the first, this would provide the first process with a way
of exercising them,” Microsoft warned.
The software giant cautioned that an attacker who had the ability to log
onto a system interactively could potentially run a program that would
piggyback on a WM_TIMER request, causing it to take any action the
attacker specified. “This would give the attacker complete control over the
system,” Microsoft said.
The withdrawn patch also made changes to several processes that run on
the interactive desktop with high privileges. Although none of these would,
in the absence of the TM_TIMER vulnerability, enable an attacker to gain
privileges on the system, Microsoft said they were included in the patch to
make the services more robust.
