Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Recently published SChannel exploit for WIndows

Posted on 2014-11-16
6
Medium Priority
?
340 Views
Last Modified: 2014-11-17
Hi Folks:

What do you all make of this recent CERT alert about the Microsoft SChannel vulnerability that allows remote exploits of WIndows systems? https://www.us-cert.gov/ncas/alerts/TA14-318A

My concern is that all the Microsoft articles to which it makes reference makes it seem like everything is sufficiently patched if you're up to date. So what exactly is new here? Is this a real new exploit? On the one hand, Microsoft articles reference various patches for different OSes that take care of different vulnerabilities. On the other hand, the guy exposing the exploit says Microsoft won't have a patch ready till December.

This seems confusing and contradictory. What do y'all think?

Thanks,
Dana
0
Comment
Question by:Dana Friedman
  • 2
  • 2
  • 2
6 Comments
 
LVL 99

Accepted Solution

by:
John Hurst earned 1000 total points
ID: 40445923
What I have read is as thick as mud. What I took away from it was to patch all workstations and servers, which is what we have done. I am sure more patches will come.

http://www.zdnet.com/drop-what-youre-doing-and-patch-the-windows-schannel-bugs-now-7000035738/?s_cid=e589&ttag=e589&ftag=TREc64629f
0
 
LVL 84

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 1000 total points
ID: 40446039
it is a 19 year old problem that has been fixed. and the addition of 4 more suites.  Windows XP unless you are using the 'embedded' patch is significantly vunerable to this exploit
0
 

Author Comment

by:Dana Friedman
ID: 40447104
David:

What do you mean "and the addition of 4 more suites"? Four more Microsoft Office suites? Something else?

Thanks,
Dana
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Closing Comment

by:Dana Friedman
ID: 40447106
Thanks to you both. I'm not sure what David's "addition of 4 more suites" refers to, but I found both to be very helpful.

Thanks,
Dana
0
 
LVL 99

Expert Comment

by:John Hurst
ID: 40447108
Thanks.   I think you just need to be sure all current patches are up to date
0
 
LVL 84

Expert Comment

by:David Johnson, CD, MVP
ID: 40447294
4 more security protcol suites

    TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
    TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
    TLS_RSA_WITH_AES_256_GCM_SHA384
    TLS_RSA_WITH_AES_128_GCM_SHA256
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A small collection of useful tips and tricks for Windows 10 users that I decided to write as a result of recent questions that were asked and answered at Experts Exchange. Two short video tutorials included. Enjoy..
The article covers five tools all IT professionals should know about, as they up productivity by a great deal!
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question