Microsoft Corp. Friday released a patch for two versions of its Windows operating system to secure a hole discovered in a critical networking technology that could allow an attacker to stage denial of service attacks or take over a user’s computer system.
The vulnerability lies in the way a number of companies implement a standard protocol that allows system administrators to manage devices in a network, such as firewalls, computers and routers, called SNMP (Simple Network Management Protocol). It was identified last week and publicized by CERT/CC (Computer Emergency Response Team/Coordination Center), a federally funded security group.
Microsoft provides an implementation of SNMP for all versions of Windows except Windows ME. The company said the protocol is not included in the operating system by default. Instead, a user must install it manually. The initial patches made available from Microsoft are for its Windows 2000 and Windows XP operating systems.
In addition to Windows, SNMP is used by a variety of vendors, including Sun Microsystems Inc. and most network equipment vendors. A list of affected vendors and fixes or workarounds for vulnerable products is available at http://www.cert.org/advisories/CA-2002-03.html#vendors/.
A workaround for the flaw as it is implemented in Windows was detailed Tuesday in a security bulletin from Microsoft. The patches released Friday should be installed in place of the workaround, Microsoft said. Patches for the remaining versions of Windows were not yet available.
Microsoft has made patches available for Windows 2000 and Windows XP users on its Web site at http://www.microsoft.com/technet/security/bulletin/ms02-006.asp.
Microsoft, based in Redmond, Wash., is at http://www.microsoft.com.