MS03-39 another Critical Windows update

iarnell · Post by **iarnell** » September 10th, 2003, 10:34 am

Heads up people. Microsoft have just announced MS03-39 (KB824146). It supersedes MS03-26, the infamous Blaster hole. So patch up now and prepare for Blaster mk II. Full details on TechNet.

chrisgeleven · Post by **chrisgeleven** » September 10th, 2003, 10:39 am

You just beat my new thread. http://forums.mozillazine.org/viewtopic.php?t=24258

Contains a news.com article and more information on the flaw.

sharkius · Post by **sharkius** » September 10th, 2003, 10:49 am

Just read that too. Now I have to restart my laptop yet again....

I could go much longer if they would just stop issuing these security updates...

September 10th, 2003, 10:52 am

Thanks guys, as I was also planning on issuing a warning ... Think of Blaster and Welshia if you need any motivation what so ever on patching ... I'm doing mine now :o

MS03-039: Microsoft Security Bulletin #39 (CRITICAL)
http://forums.mcafeehelp.com/viewtopic.php?t=15955

iarnell · Post by **iarnell** » September 10th, 2003, 12:17 pm

I thought you must have been on vacation - I checked here and at McAfee before posting. It's very rare that you're not first with the news on updates.

September 10th, 2003, 12:39 pm

Thanks Iain for starting this important thread ... I had to warn our ADMINS first plus I'm wrapped up in a ton of stuff at work - LOL

GREEN LIGHT on this one ... I just wanted to share that this 200KB patch installed fine on two W/2000 SP4 PCs, XP SP1, and Windows 2003 Server. You'll need to reboot after updating. Zero issues so far, so this seems solid to me.

chrisgeleven · Post by **chrisgeleven** » September 10th, 2003, 12:44 pm

Patch works fine in WinXP SP1 here as well.

My university is still trying to clean up after blaster came along with all of the new students a week ago. Today is the first day I can actually use the internet without many problems. Another virus like Blaster is going to drive them nuts. Sounds like they are going to use MAC addresses in the future to shutdown internet access to computers that are detected with any viruses, problem is I don't know how soon such a system will be launched.

Dunderklumpen · Post by **Dunderklumpen** » September 11th, 2003, 2:06 am

Patch your Windows system and close ports:

UDP:135, 137, 138 och 445.
TCP:135, 139, 445 and 593
And switch off COM Internet Services and RPC over HTTP

After doing that - sit down, get a cup of coffee and just wait for the worm/virus that will come.

September 11th, 2003, 2:32 am

Dunderklumpen wrote:Patch your Windows system and close ports:

UDP:135, 137, 138 and 445.
TCP:135, 139, 445 and 593
And switch off COM Internet Services and RPC over HTTP

After doing that - sit down, get a cup of coffee and just wait for the worm/virus that will come.

Hi Mikael -- Thanks for sharing that great consise advice ... I don't know whether to laugh or cry on the getting the cup of coffee advice

R@F · Post by **R@F** » September 11th, 2003, 3:46 am

I suggest laughing, Harry... What else can we do?

September 11th, 2003, 6:55 am

As I shared in our McAfee forums ... Mikael is right on point, time to go refill the coffee cup and hope for the best as we're patching like crazy now

New Windows virus may hit soon
http://news.com.com/2100%2D1002%2D5074415.html

It’s going to be another patch race. A virus or worm that exploits newly revealed vulnerabilities in the current versions of Windows could emerge fairly soon, security experts say, in part because the vulnerabilities are very similar to the flaws exploited by the MSBlast worm.

“This is essentially the same type of vulnerability,” said Alfred Huger, senior director of engineering at Symantec Security Response. “We’re likely to see them (new viruses) in the near future.”

Code that exploits the vulnerability is already being exchanged among researchers, he said. A new virus could come out in the next few days, he added, if not sooner. Robin Matlock, vice president of marketing at Network Associates, speculated that an exploit might take a few weeks. Still, “the gap between vulnerabilities and exploits is shrinking dramatically,” she said.

Dunderklumpen · Post by **Dunderklumpen** » September 11th, 2003, 9:12 am

harrywaldron wrote:
Dunderklumpen wrote:Patch your Windows system and close ports:

UDP:135, 137, 138 and 445.
TCP:135, 139, 445 and 593
And switch off COM Internet Services and RPC over HTTP

After doing that - sit down, get a cup of coffee and just wait for the worm/virus that will come.

Hi Mikael -- Thanks for sharing that great consise advice ... I don't know whether to laugh or cry on the getting the cup of coffee advice

Well - the worm/virus will come and the coffee will keep us alert and awake when it does :-)

Also - properly patched and with all the necessary ports closed - you deserve a cup of coffee.

Hendikins · Post by **Hendikins** » September 13th, 2003, 4:37 am

Growl. Just patched the parents' network.

chrisgeleven · Post by **chrisgeleven** » September 13th, 2003, 11:43 am

You know, these network worms would be stopped (at least on XP) if you enable the firewall included (until flaws are found in the firewall ](*,)

. In fact, I believe I saw a quote from Microsoft somewhere that says they are seriously considering having the firewall enabled by default in future service packs/versions of Windows.

Every XP computer I checked to top stop the spread of Blaster, I enabled the firewall.

Dunderklumpen · Post by **Dunderklumpen** » September 13th, 2003, 11:58 am

chrisgeleven wrote:Every XP computer I checked to top stop the spread of Blaster, I enabled the firewall.

True, worms of this type will be stoped with a firewall and Microsoft has decided that the internal Firewall in Windows XP will be shiped enabled.