Solved

Recently published SChannel exploit for WIndows

Posted on 2014-11-16
6
326 Views
Last Modified: 2014-11-17
Hi Folks:

What do you all make of this recent CERT alert about the Microsoft SChannel vulnerability that allows remote exploits of WIndows systems? https://www.us-cert.gov/ncas/alerts/TA14-318A

My concern is that all the Microsoft articles to which it makes reference makes it seem like everything is sufficiently patched if you're up to date. So what exactly is new here? Is this a real new exploit? On the one hand, Microsoft articles reference various patches for different OSes that take care of different vulnerabilities. On the other hand, the guy exposing the exploit says Microsoft won't have a patch ready till December.

This seems confusing and contradictory. What do y'all think?

Thanks,
Dana
0
Comment
Question by:dragonflytech
  • 2
  • 2
  • 2
6 Comments
 
LVL 93

Accepted Solution

by:
John Hurst earned 250 total points
ID: 40445923
What I have read is as thick as mud. What I took away from it was to patch all workstations and servers, which is what we have done. I am sure more patches will come.

http://www.zdnet.com/drop-what-youre-doing-and-patch-the-windows-schannel-bugs-now-7000035738/?s_cid=e589&ttag=e589&ftag=TREc64629f
0
 
LVL 80

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 250 total points
ID: 40446039
it is a 19 year old problem that has been fixed. and the addition of 4 more suites.  Windows XP unless you are using the 'embedded' patch is significantly vunerable to this exploit
0
 

Author Comment

by:dragonflytech
ID: 40447104
David:

What do you mean "and the addition of 4 more suites"? Four more Microsoft Office suites? Something else?

Thanks,
Dana
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 

Author Closing Comment

by:dragonflytech
ID: 40447106
Thanks to you both. I'm not sure what David's "addition of 4 more suites" refers to, but I found both to be very helpful.

Thanks,
Dana
0
 
LVL 93

Expert Comment

by:John Hurst
ID: 40447108
Thanks.   I think you just need to be sure all current patches are up to date
0
 
LVL 80

Expert Comment

by:David Johnson, CD, MVP
ID: 40447294
4 more security protcol suites

    TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
    TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
    TLS_RSA_WITH_AES_256_GCM_SHA384
    TLS_RSA_WITH_AES_128_GCM_SHA256
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
It’s been over a month into 2017, and there is already a sophisticated Gmail phishing email making it rounds. New techniques and tactics, have given hackers a way to authentically impersonate your contacts.How it Works The attack works by targeti…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question