Security is a critical component of the service ANS offers our clients and is a matter of the highest priority to our team. As such, we wanted to take a minute to make our clients aware of a new vulnerability that surfaced last Tuesday (November 4, 2014).
This vulnerability impacts all versions of Windows running IIS, dating back to Windows Server 2003. Just as OpenSSL implements SSL on many Unix/Linux system, SCHANNEL is the standard SSL library that ships with Windows. Most Windows software that takes advantage of SSL is expected to use SCHANNEL.
Microsoft stated that a specially formed packet is all that is needed in order to take over a web server and allow remote code execution. In addition to Web Servers, Exchange Servers are also impacted by this vulnerability. Since Web and Exchange servers have their ports exposed to the internet to allow for remote connections, it is critical that users be aware of this potential exploit. Microsoft is recommending that all affected systems are patched as soon as possible.
As soon as our engineers received word of this threat, they began an evaluation of all customers systems managed by ANS to identify any potentially affected servers. Upon identifying the vulnerable servers, our managed services team scheduled and pushed out a patch to address this vulnerability.
If you have any questions or concerns, feel free to email support@90bc.net
Sincerely,
The ANS Team
For more information on CVE-2014-6321 please follow the links below:
[1] http://technet.microsoft.com/library/security/MS14-066
[2] http://community.rapid7.com/community/infosec/blog/2014/11/12/schannel-and-ms14-066-another-red-alert
[3] http://www.tenable.com/blog/is-ms14-066-the-windows-shellshock
[4] http://blogs.cisco.com/security/talos/ms-tuesday-nov-2014
[5] http://www.computerworld.com/article/2846037/security0/33-bugs-14-patch-tuesday-microsoftitbwcw.html