New Windows exploit could disable firewall

O

octave

Contributor
Tgdaily
Security researchers have discovered a new Windows flaw that could allow hackers to crash the built-in firewall. By sending malformed DNS packets to vulnerable machines, hackers could disable and eventually bypass the operating system firewall. So far only Windows XP computers with the Internet Connection Sharing (ICS) service turned on are affected by the attack.
Ncircle's Tyler Reguly has posted more information about the exploit on his company blog. He says the attack is directed at the virtual DNS server and must come from inside the internal network. Malformed DNS packets can crash the DNS server which causes a chain reaction and crashes ICS and then the firewall.
The new exploit shouldn't be a major problem for most Windows users because the vulnerable ICS service must be explicitly turned on. The ICS menu option is located in a rather obscure spot under the Window's network properties and is mainly tinkered with by MCSE students or very curious people. In addition, inexpensive modern routers, which split Internet connections and provide basic firewall services, have eliminated any need to use ICS.
.
Click to expand...
 
THE CASE OF THE crumbling firewall vulnerability in Windows XP is "easily fixable" say insecurity experts
The vulnerability lies within the Windows Internet Connection Service (ICS), a component that lets users share one computer's internet connection with other machines on a Lan.

And, according to security company Sunbelt Software most users do not even use the ICS component.

Alex Eckelberry, president of Sunbelt Software, maintained that any attack would have to take place from a computer within the Lan, and that the vulnerability is not exploitable by any outside attack methods such as specially-crafted web pages or emails.

Security firms Sunbelt and Secunia offer a simple fix for the vulnerability by using a router to share internet connections on a Lan rather than relying on ICS.
Click to expand...

Windows firewall exploit no cause for concern
 
Back
Top