'Huge Increase' in Worm Attacks Plague Unpatched Windows PCs
A computer worm that exploits a Windows bug Microsoft Corp. patched more than two months ago continues to wreak havoc, a security company said Monday, as it boosted its overall threat ranking and warned users to patch their PCs.
"I'm not surprised that there are unpatched systems out there," Greenbaum said. "But I have been somewhat surprised by the number of unprotected systems. Anytime that Microsoft issues an out-of-cycle patch, users should pay attention."
Apparently, users didn't listen. In early December, Qualys Inc. concluded that the patching pace for the October emergency fix was similar to the rate at which people fixed flaws that Microsoft issued several weeks later on its regularly scheduled Patch Tuesday.
Users' lackadaisical approach to the emergency patch prompted one Microsoft executive to claim that some customers were "playing Russian Roulette" with their networks by not deploying the fix. In a post to his blog Sunday, Roger Halbheer, the chief security adviser for Microsoft's Europe, Middle East and Africa group, scolded users. "If you decide not to roll out a security update which is so critical that we decide to go out of band, you play Russian roulette with your network, as you can guess that there will be attacks exploiting this vulnerability pretty soon," said Halbheer.
More information about the vulnerability, and links to the patch, can be found in the MS08-067 security bulletin on Microsoft's Web site.
Microsoft
Receive the latest security news as it breaks.
