Broadband Tech > Security > Security > Vista, Win7, Server 2008 BSOD Exploit

reply to SUMware

Re: Vista, Win7, Server 2008 BSOD Exploit

quote:

---

Microsoft has promised to patch a serious flaw in newer versions of its Windows operating system after hackers released exploit code that allows them to take complete control of the underlying machines.

The flaw, which affects various versions of Windows Vista, 2008, and the release candidate version of Windows 7, resides in the implementation of a network file sharing technology known as SMB, or server message block. The bug, which fails to adequately parse network negotiation requests, was previously believed only to generate a debilitating blue screen of death, but on Tuesday, Microsoft confirmed in some cases it could also be used to remotely execute malicious code on vulnerable machines.

The revelation shows that Microsoft's recent efforts to harden its software against attack only go so far. Despite building Windows Vista and 2008 from scratch and subjecting them to rigorous code reviews, the critical bug managed to escape notice. Even worse, security reviewers in Redmond managed to purge the bug from the final version of Windows 7, but allowed other Windows versions to remain vulnerable.

---

quote:

---

Microsoft has issued a formal security advisory in response to the latest flaw discovered within its Windows operating systems, shedding a bit of light on the issue. According to CNET, Microsoft believes that the flaw will not cause any problems for Windows 7 users, and instead only for those on Windows Vista and Windows Server 2008 (not Server 2008 R2, though).

The advisory, found here, stated the following: Microsoft is investigating new public reports of a possible vulnerability in Microsoft Server Message Block (SMB) implementation. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.
We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.

---

So let me get this straight, Windows 7 RTM isn't vulnerable?
--
Tom

said by trparky

quote:

---

So let me get this straight, Windows 7 RTM isn't vulnerable?

---

quote:

---

To be fair, most attempts to exploit the bug will result in a simple crash of the machine, according to an advisory Microsoft published on Tuesday. What's more, the invulnerability of Windows 7 and Server 2008 R2 suggests Microsoft's security team is at least partially on top of the bug.

---