Zero-day Windows Vista, 7 vulnerability discovered

Status
Not open for further replies.

Matthew DeCarlo

Posts: 5,271   +104

Update: CNET has reported that Microsoft said the flaw does not affect the final version of Windows 7.

Microsoft is looking into a zero-day vulnerability today, which reportedly affects systems running Windows Vista and 7. Researcher Laurent Gaffie said that a hacker could exploit the flaw on Windows 7 to cause a critical system error. The flaw lies in a Server Message Block 2 (SMB2) driver.

Gaffie said in a blog post yesterday, "SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionality." People who have commented on his blog post are reporting that the exploit can not only lead to denial of service, but also remote code execution.

Gaffie has contacted Microsoft, and it has since responded by saying that it is investigating the issue but that it is "unaware of any attacks trying to use the claimed vulnerability or of customer impact." The H has successfully tested the proof-of-concept code, which caused a reboot on Vista -- but did not work on Windows 7.

Permalink to story.

 
If they spent all their time figuring this out on the RC, that was NT Kernel 6.1 (just above Vista) and the release won't be involved as it will be 7.0 (they say there won't be any changes, but come on.)
Then again, could just be another non-Linux OS thats destroyable out of the box. Not like OSX is any safer by any stretch of the imagination.
 
"has successfully tested the proof-of-concept code, which caused a reboot on Vista -- but did not work on Windows 7."
I guess my idea of "success" is different from theirs.
 
Isn't the headline misleading? It appears to be stating that Windows 7 is vulnerable to this exploit when in fact, it's not.
http://news.cnet.com/8301-13860_3-10347289-56.html?tag=newsEditorsPicksArea.0
 
According to the linked report, it does not affect the "final version of Windows 7" -- if I am understanding that correctly, then I assume it still affects the RC and any other pre-release build.

Also as a side note, CNET's article was published many hours after ours (with new details that presumably weren't available when the TechSpot post went live). I will update the TechSpot post with CNET's report, but the title will remain intact. Thanks.
 
Status
Not open for further replies.
Back