Microsoft downplays Server bug threat, say researchers

10.05.2011
Microsoft is downplaying the threat posed by one of the three bugs the company patched today, said security researchers.

The update in question, , patches a single vulnerability in WINS (Windows Internet Name Service), a component in every supported edition of Windows Server, including Server 2003, 2008 and the newest, Server 2008 R2.

Attackers could exploit the WINS bug by crafting a malicious data packet, then shooting it at a vulnerable Windows Server box.

What irked researchers is that although Microsoft rated the bug as "critical," the company's highest threat ranking, it also pointed out that WINS is not installed by default, citing that as a mitigation factor.

While true, that overlooks the fact that many networks, especially larger ones in enterprises and government agencies, have WINS installed.

"Most organizations have to install WINS," said Marcus Carey, Rapid7's enterprise security community manager. "With governments and big agencies -- any large network -- WINS is going to be running."