Inside Iowa State: Iowa State University

September 12, 2003

Get latest windows patch now

It's time to run another patch on your Microsoft Windows system and the sooner, the better.

A newly discovered security hole in the Microsoft Windows system could open your PC to a host of viruses and worms. You want to plug that hole now before anyone exploits it.

According to Jeff Balvanz, systems analyst in Academic Information Technologies (AIT), "Microsoft has announced another critical vulnerability in Windows NT, Windows 2000, Windows XP and Windows 2003 Server, similar to the one discovered in July that led to the LovSan (MSBlast) and Nachi worms. This flaw in RPC (the Remote Procedure Call service) could also allow an attacker to execute programs on a vulnerable machine from a remote location on the network. So far, there are no known exploits of this vulnerability, but it is only a matter of time before attackers begin using this pathway to break into systems."

"We blocked approximately 1,500 systems on campus from Internet access for the last exploit," said Frank Poduska, AIT's Solution Center manager. "It was less than three weeks between the discovery of the vulnerability and release of the worm exploiting it. Setting up automatic updates, and verifying they are happening, is one way to protect your computer."

Users of Windows NT 4.0, Windows 2000 and Windows XP should update their systems immediately, either through the Windows Update page at http://windowsupdate.microsoft.com or using the patch packages available locally at http://www.public.iastate.edu/~virus. Persons responsible for more than one machine should note that there are different versions of the patch for Windows NT 4.0 Workstation, NT 4.0 Server, Windows 2000 and Windows XP. Computers running Windows 95, Windows 98, and Windows ME are not vulnerable to this exploit; neither are Macintosh or Unix computers (including Linux). More information is available from Microsoft at http://www.microsoft.com/security/security_bulletins/ms03-039.asp and http://www.microsoft.com/technet/security/bulletin/MS03-039.asp