IBM Internet Security Systems shields customers from critical Microsoft vulnerabilities.

IBM recently announced its Internet Security Systems division is keeping customers ahead of threats posed by the most recent Microsoft vulnerabilities. Earlier this month, IBM Internet Security Systems discovered active exploitation of a vulnerability in Microsoft's XML HTTP request handling through Internet Explorer, which Microsoft provided a patch for today. The vulnerability makes it possible for attackers to remotely execute malicious code on a victim's machine, leading to compromise of corporate networks and confidential information.

At the time of discovery in early November, IBM products were already providing customers with preemptive protection for this threat through its Buffer Overflow Exploit Prevention (BOEP) solution and through its protocol analysis module (PAM), the core engine that powers IBM Internet Security Systems intrusion prevention and detection technologies. IBM also alerted Microsoft of its findings and provided customers with additional protection at that time. "This particular threat to Microsoft's XML HTTP request handling demonstrates the criticality of preemptive protection," said Lamar Bailey, Senior Operations Manager for the IBM X-Force research and development team. "Without proactive security technologies in place, organizations leave themselves dangerously open to attack by zero-day exploits such as the ones that targeted this vulnerability. By waiting for a signature to protect your network, you are dramatically increasing the attackers' opportunities to compromise your system."

IBM is also providing protection for the latest critical threat to Microsoft users, a remote code execution vulnerability announced in the Microsoft Workstation Service, which maintains client connections to Windows Networking services and runs by default on Microsoft Operating Systems. According to X-Force, this vulnerability is simple to exploit and successful compromise could leave the attacker in complete control of the targeted machine. While authentication is required to access this service remotely in Windows XP, it is not required in Windows 2000, making this vulnerability a serious risk to Windows 2000 networks. This vulnerability could also be exploited by worms or other malware.

X-Force also encourages organizations to apply the patches provided today by Microsoft for the Internet Explorer vulnerabilities addressed in bulletin MS06-067. Several of these vulnerabilities have been exploited in the wild since September. IBM customers have been protected from these vulnerabilities since then, but other companies are urged to apply appropriate patches.

www.iss.net