[August 2005] Vulnerability found in Microsoft Plug and Play

Security risk found in July

Summer is turning to Fall, the leaves are beginning to collect on the ground and, although we have to say goodbye to the summer sun for the time being, we have a hot new issue to which we must turn our attention. Earlier this month Microsoft announced the discovery of a new MS05-039 Plug and Play (PnP) service vulnerability. In reaction to this announcement, ASEC ( AhnLab Security E-response Center ) began preparing for the inevitable appearance of worms and viruses expected to take advantage of this newfound weakness. As we anticipated, our vigilance paid off and allowed for the early discovery of new worms and malicious code circulating on the Net. Early detection of this kind of threat is critical to decrease the creation time of malicious code and to prevent a truly widespread outbreak.

System Risk	Vulnerability	Malicious Code (YES/NO)

MID	Vulnerability of Remote code execution exist in Msdds.dll library	YES

MID	Microsoft Windows RDP(Remote Desktop Protocol) Denial of Service Attack (MS05-041)	YES

HIGH	Internet Explorer COM Objects related vulnerability (MS05-038)	YES

HIGH	Microsoft PnP(Plug and Play) Buffer overflow Vulnerability (MS05-039)	YES

[1] Major vulnerability found in August

Malicious code exposure and expected Worm appearance

The risk to computer users by malicious code has been on the rise lately as vulnerabilities and security breaches are uncovered within their systems. In particular, Microsoft (MS) products have been a major target for these forms of attack. In an attempt to counter this onslaught, MS releases security vulnerability patches on the second Tuesday of every month. In their most recent release, Microsoft announced 6 patches. From these patches, the PnP service was noted to have the weakness of remote execution which allows it to be used by malicious code as a spring board into a user's system. These types of attacks are especially insidious because of the multitude of users who can be affected and the ease with which vulnerabilities can go unnoticed.
Displayed below is a time table which lists the events that took place from the announcement of MS05-039 to the appearance of the first instance of malicious code.

2005/08/09 MS05-039 MS announce Security vulnerability warning
2005/08/11 MS05-039 first and second attacking code found ( Infrequent attacking code)
2005/08/12 MS05-039 third attacking code found (Code that used on Malicious code)
2005/08/14 Zotob.A worm discovered (Afternoon of 14th)
2005/08/14 Zotob.B
2005/08/15 Zotob.C - Mass Mailer feature included

Within three days of the announcement, the malicious code used within the worm had been exposed. Two days after this exposure, the (Zotob) worm was discovered. It can typically be expected that as time proceeds and the awareness of vulnerabilities is increased, the interval between release and discovery of malicious code decreases, thereby reducing the potential damage caused by these and other harmful internet threats. The development of the malicious code used in this worm was claimed by the creator of the Blaster Worm. Even though the offending code targeted only Windows 2000, and it had an inaccurate offset position on Korean Windows systems, system administrators and end-users need to be especially aware of vulnerabilities that can contribute to the widespread destruction caused by worms such as these.

AhnLab ASEC
Written by Jung Kwang Jin, Sr. Researcher

[August 2005] Vulnerability found in Microsoft Plug and Play

Related Content