Zero-day Windows Vista, 7 vulnerability discovered

By on September 8, 2009, 2:06 PM
Update: CNET has reported that Microsoft said the flaw does not affect the final version of Windows 7.

Microsoft is looking into a zero-day vulnerability today, which reportedly affects systems running Windows Vista and 7. Researcher Laurent Gaffie said that a hacker could exploit the flaw on Windows 7 to cause a critical system error. The flaw lies in a Server Message Block 2 (SMB2) driver.

Gaffie said in a blog post yesterday, "SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionality." People who have commented on his blog post are reporting that the exploit can not only lead to denial of service, but also remote code execution.

Gaffie has contacted Microsoft, and it has since responded by saying that it is investigating the issue but that it is "unaware of any attacks trying to use the claimed vulnerability or of customer impact." The H has successfully tested the proof-of-concept code, which caused a reboot on Vista -- but did not work on Windows 7.

User Comments: 5

Got something to say? Post a comment
tengeta tengeta said:

If they spent all their time figuring this out on the RC, that was NT Kernel 6.1 (just above Vista) and the release won't be involved as it will be 7.0 (they say there won't be any changes, but come on.)

Then again, could just be another non-Linux OS thats destroyable out of the box. Not like OSX is any safer by any stretch of the imagination.

yukka, TechSpot Paladin, said:

stuff this "no one is currently using this" line - fix plx ms.

NunjaBusiness said:

"has successfully tested the proof-of-concept code, which caused a reboot on Vista -- but did not work on Windows 7."

I guess my idea of "success" is different from theirs.

isamuelson isamuelson said:

Isn't the headline misleading? It appears to be stating that Windows 7 is vulnerable to this exploit when in fact, it's not.

Matthew Matthew, TechSpot Staff, said:

According to the linked report, it does not affect the "final version of Windows 7" -- if I am understanding that correctly, then I assume it still affects the RC and any other pre-release build.

Also as a side note, CNET's article was published many hours after ours (with new details that presumably weren't available when the TechSpot post went live). I will update the TechSpot post with CNET's report, but the title will remain intact. Thanks.

Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.