Microsoft Issues Emergency Advisory

Just last week we warned admins and end users alike that they'd better apply the patch released last week in security update MS08-067. Today, Microsoft warned users that exploits that target the vulnerability are circulating in the wild. Hate to say it: Told You So.This is from the advisory (958963) released today: "Microsoft is aware that detailed exploit code demonstrating code execution has been published on the Internet for the vulnerability that is addressed by security update MS08-067. This exploit code demonstrates code execution on Windows 2000, Windows XP, and Windows Server 2003. Microsoft is aware of limited, targeted active attacks that use this exploit code. At this time, there are no self-replicating attacks associated with this vulnerability. Microsoft has activated its Software Security Incident Response Process (SSIRP) and is continuing to investigate this issue.

Our investigation of this exploit code has verified that it does not affect customers who have installed the updates detailed in MS08-067 on their computers. Microsoft continues to recommend that customers apply the updates to the affected products by enabling the Automatic Updates feature in Windows.

" A quick translation: It looks like Vista isn't affected by this specific exploit (but is vulnerable to the flaw that was patched on Oct. 23), but XP, Windows 2000, and Windows Server 2003 all remain at-risk if not patched. The good news: no worm yet.

History says these types of exploits can be fairly straightforward to flip into a worm. So we're not out of the water yet, and if you haven't patched it's still a very good idea to do so.

Here's the original Microsoft Security Bulletin MS08-067.