Microsoft has announced that it has taken care of a bug that may have been around for some 15 years, and could have put millions of PC users running all version of Windows at risk of giving attackers complete control of their machine.

The vulnerability, codenamed Jasburg, which Microsoft says took a year to clean-up, still remains a critical vulnerability in Windows Server 2003, although the Redmond company has suggested that users update their operating system as an upgrade would jeopardize system stability and cause application compatibility problems. If an attacker were to be successful they could “install programs; view, change, or delete data; or create new accounts with full user rights,” Microsoft reported.

The bug, which was discovered by JAS Global Advisors, a security company based in Chicago IL, could affect users connected to a corporate, business Active Directory network by allowing an attacker to act as a man-in-the-middle between user and network, enabling the attacker to exploit a vulnerable machine. Roaming computers connected to public Wi-Fi are at “heightened risk”, JAS said in a statement. Microsoft also gave an example as a “risk scenario” of users being attacked while using public Wi-Fi in a coffee shop.

The reason the fix took so long to implement was due to it being an unusual, or “unprecedented” vulnerability, in that, “Unlike recent high-profile vulnerabilities like Heartbleed, Shellshock, Gotofail, and POODLE, this is a design problem not an implementation problem. The fix required Microsoft to re-engineer core components of the operating system and to add several new features,” wrote JAS. The company added that rigorous attention had to be paid to backwards compatibility, and regression testing by Microsoft had to be performed to lesson side-effects of the fix. A “fix it right” policy, rather than a perhaps not so successful “fix it fast” procedure was said to be embraced by Microsoft.

Because of the profound nature of the flaw and new features that need to be configured on Active Directory Clients and Servers, IT professionals working in Microsoft environments have been advised to “move rapidly” and seek support. An overview of the vulnerability is available here.

Photo credit: Microsoft Jasburg scenario