Attackers could exploit the bug to remotely control a PC, and so users are being urged to download updates.
Gavin Millard, from Tenable Network Security, “Is WinShock as bad as Heartbleed? At the moment, due to the lack of details and proof-of-concept code, it’s hard to say, but a remote code execution vulnerability affecting all versions of Windows server on a common component like Schannel is up there with the worst of them.”
It is unknown if the attack has been used against any Windows machines so far, the patch is now available, but attackers may target the computers that have not yet been patched.
No patch for unsupported XP, even though some say the “Winshock” bug in Windows’ SSL/TLS installation is worse than Heartbleed.
Amichai Schulman, CTO of Imperva, said: “The advisory from Microsoft does not state that hosts running web servers are more vulnerable than others to this. It seems that while the same patch includes enhancement to the TLS ciphersuite list, this enhancement has nothing to do with the vulnerability being patched.
“If this vulnerability is indeed exploitable via SSL / TLS it is more sever in nature than Heartbleed because this is a remote code execution vulnerability – it allows the attacker to completely take over the server (while Heartbleed attempted, opportunistically to collect sensitive information).”
‘This security update resolves a privately reported vulnerability in the Microsoft Secure Channel (Schannel) security package in Windows. The vulnerability could allow remote code execution if an attacker sends specially crafted packets to a Windows server.
This security update is rated Critical for all supported releases of Microsoft Windows.’
Secure Channel (Schannel)
The Secure Channel (Schannel) security package is a Security Support Provider (SSP) that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) Internet standard authentication protocols. These components are used to implement secure communications in support of several common internet and network applications, such as web browsing. Schannel is part of the security package that helps provide an authentication service to provide secure communications between client and server.
WinShock has been graded as 10 out of a possible 10 on the Common Vulnerability Scoring System (CVSS).
Publish Date : 2014-11-11
No public claims of “exploits” for Winshock exist yet, its important that servers get patched before attackers are able to research and carry out the exploit.
Along with patching users should also update their IPS systems to deal with it.