Go to:

IT Jobs

A day after Microsoft plugged more than a dozen holes in its software, a security researcher unveiled a new unpatched bug in Windows 7 and Server 2008 R2 that, when exploited, locks up the system, requiring a total shutdown to regain control.

Microsoft acknowledged that it's investigating the flaw.

Laurent Gaffie posted details of the vulnerabilities, along with proof-of-concept exploit code, to the Full Disclosure security mailing list today, as well as to his personal blog. The attack code, said Gaffie, crashes the kernel in Windows 7 and its server sibling, Windows Server 2008 R2, triggering an infinite loop.

Microsoft issues critical Internet Explorer patch | Old Microsoft Office patch protects against most attacks | Microsoft left Windows 7 open to hackers, says Sophos

"No BSOD [Blue Screen of Death], you gotta pull the plug," Gaffie said in notes inserted into the exploit code .

Gaffie claimed that the exploit, powered by a vulnerability in the new operating systems' implementation of SMB (Server Message Block), could be successfully launched from within a network from an already compromised computer, or used to attack Windows 7 machines via Internet Explorer (IE) by transmitting a rogue SMB packet to the PC.

Unlike more serious flaws, the Windows 7 SMB bug cannot be used by attackers to hijack a PC, Gaffie confirmed. "No code execution, but a remote kernel crash," he said in an e-mail today.

Gaffie also said that Microsoft's security team has acknowledged the vulnerability, which he first reported to them last weekend, but was told by the company that it wasn't planning to fix the flaw with a security update, instead perhaps correcting it in the first service packs for Windows 7 and Server 2008 R2.

A Microsoft spokesman confirmed that the company is looking into Gaffie's claims. "Microsoft is investigating new public claims of a possible denial-of-service vulnerability in Windows Server Message Block," said the spokesman in an e-mail reply to questions. "Once we re done investigating, we will take appropriate action & [which] may include providing a security update through the monthly release process, an out-of-cycle update or additional guidance to help customers protect themselves."

Gaffie's disclosure came just a day after Microsoft issued November's security updates , which patched 15 vulnerabilities in Windows, Windows Server and Office. None of the 15 affected the final version of Windows 7, which was released to retail Oct. 22, or affected Windows Server 2008 R2.

Contact Us

For editorial queries:
Max Cooter max_cooter@techworld.com

For website issues:
Email webmaster@techworld.com

For commercial queries
Russell Kearney russell_kearney@idg.co.uk

For more contact details click here.

Latest White Papers

A buyer's guide to hosted security
>> Download whitepaper

Is social networking really bad for business?
>> Download whitepaper

Phishing for victims: Truth, myth and cybercrime
>> Download whitepaper

Question of the day!

Does your smartphone replace your need for a laptop when on the move?

% of Techworld readers agree with you

Yes

TBC

No

TBC

What tasks can your smartphone do that would have traditionally been done on a laptop?

Tweet your answer here...

Twitter account details

Username: Password:

Don't worry, your login info is sent through the secure Twitter API and is not stored.

119 characters remaining

Follow the conversation at @SmartphoneFocus