Microsoft confirms it missed Stuxnet print spooler 'zero-day'

Researcher published info, exploit on print spooler vulnerability in April 2009

Contrary to reports, a bug that Microsoft patched last week had been publicly discussed a year and a half ago, security researchers said this week.

Microsoft confirmed Wednesday that it overlooked the vulnerability when it was revealed last year.

The vulnerability in Windows Print Spooler service was one of four exploited by Stuxnet, a worm that some have suggested was crafted to sabotage an Iranian nuclear reactor .

Last week, researchers at both Kaspersky Lab and Symantec, the firms that had reported the bug to Microsoft in July and August, respectively, said the print spooler vulnerability had not been publicly disclosed before they found Stuxnet was using the flaw.

Stuxnet raised the eyebrows of security experts for a variety of reasons, including its use of four different unknown, unpatched Windows vulnerabilities. Such bugs are often labeled "zero-days" because attackers exploit them before the relevant developer knows of the flaw.

It turns out that one of the four -- the vulnerability Microsoft patched last week with its MS10-061 update -- was technically not a zero-day, said Liam O Murchu, manager of operations with Symantec's security response team.

According to O Murchu, the print spooler flaw was first revealed in a security publication's 2009 issue. He did not name the magazine. On Wednesday, a Symantec spokesman declined to identify the publication, saying the article "has the source code needed to carry out the attack, info which is not publicly known yet."

But the cat is already out of the bag.

Paris-based Vupen Security , however, pointed a finger at Hackin9 , a Polish publication. Computerworld was easily able to locate a PDF of the 2009 issue on the Internet.

In that issue, a researcher named Carsten Kohler spelled out how to abuse the print spooler service to hijack Windows PCs and even included source code for a working exploit.

An exploit for the MS10-061 bug has also been added to the open-source Metasploit penetration testing framework by researcher Joshua Drake, who posted his attack code last Friday.

In an updated blog post , Symantec's O Murchu said Microsoft had told him that the Sept. 15 MS10-061 update patched the flaw that Kohler had exploited in his write-up.

Microsoft confirmed that today.

"Microsoft is aware of claims that the print spooler vulnerability in MS10-061 was partially discussed in a publication in April 2009," said company spokesman Dave Forstrom in an e-mail Wednesday. "These claims are accurate. Microsoft was not directly made aware of this vulnerability nor its publication at the time of release."

Forstrom went on to say that the bug was independently "re-discovered during the investigation of the Stuxnet malware" by Kaspersky Lab and Symantec.

The security firms also notified Microsoft of two other unpatched bugs that the Stuxnet worm exploited. Those flaws, which can be used by attackers to upgrade access privileges on compromised PCs to administrator status, will be patched in a future update, Microsoft said last week. It has not set a timetable for the fixes, however.

Little information is available about the two lesser vulnerabilities. Danish bug tracker Secunia, for example, has posted only bare-bones advisories, noting that one affects Windows XP while the other affects Vista and Windows Server 2008 machines.

Users can protect their computers against the print spooler exploits by downloading and installing MS10-061 via the Microsoft Update and Windows Update services, or through Windows Server Update Services.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Microsoftoperating systemssoftwareWindowssymanteckaspersky labMalware and Vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?