Must Read: Apple to Congress: We do not use 'tax gimmicks'

Topic: Software

Windows 7 dinged by new zero-day vulnerability

Summary: Microsoft's Windows 7 operating system is vulnerable to a new zero-day vulnerability that exposes users to blue-screen crashes or code execution attacks.

Ryan Naraine

By for Zero Day |

Microsoft's Windows 7 operating system is vulnerable to a new zero-day vulnerability that exposes users to blue-screen crashes or code execution attacks.

The flaw could be exploited by local attackers to cause a denial-of-service or potentially gain elevated privileges, according to an advisory from VUPEN, a French security research outfit.From VUPEN's advisory:

This issue is caused by a buffer overflow error in the "CreateDIBPalette()" function within the kernel-mode device driver "Win32k.sys" when using the "biClrUsed" member value of a "BITMAPINFOHEADER" structure as a counter while retrieving Bitmap data from the clipboard, which could be exploited by malicious users to crash an affected system or potentially execute arbitrary code with kernel privileges.

The flaw is confirmed on fully patched Microsoft Windows 7, Windows Server 2008 SP2, Windows Server 2003 SP2, Windows Vista SP2, and Microsoft Windows XP SP3.

Microsoft is investigating.

Topics: Software, Microsoft, Operating Systems, Windows

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

125 comments
Log in or register to join the discussion

  • RE: Windows 7 dinged by new zero-day vulnerability

    Local attackers? Having physical access to the machine itself allows all kinds of things, far worse than elevated privileges.
    Loverock Davidson
    Reply Vote

    • RE: Windows 7 dinged by new zero-day vulnerability

      @Loverock Davidson

      Lovie maybe its time you got of the Microsoft merry go round and joined everyone else in the real world of computing. Your voice is starting to sound like a over redundant message recording. Time to finally give it a rest Lovie.
      Linux_Lives
      Reply Vote

      • RE: Windows 7 dinged by new zero-day vulnerability

        @SoYouSaid

        Just be happy that he isn't on a rant about how this vulnerability should never have been made publicly known until Microsoft had had at least a year or two to bring a patch out. VUPEN Security should be vilified. Arkon, at the very least, placed in stocks, blacklisted and so on.

        After all, Lovie runs Windows since it is the ONLY secure operating system. It's terribly unkind of anyone to disturb that fantasy and force him to face the reality that no OS is completely secure and bugfree.

        Kinda reminds me of a columnist (easily identified by his Windows logo tattoo) who never admitted to having any problems with Windows 3.1/3.11 until after the release of Windows 95 when he suddenly admitted to having had problems with 3.1/3.11.
        DNSB
        Reply Vote

      • RE: Windows 7 dinged by new zero-day vulnerability

        @SoYouSaid
        Not to defend Loverock, but since when did the real computer world only consist of 10-14% of all PCs? For a fake PC it can do everything I need it to do without problems day in and day out.
        Cyrorm
        Reply Vote

      • News Flash...

        @SoYouSaid
        Given Windows has a 90 odd% grip on market share, sounds a LOT like you have that bass ackwards...

        For what it's worth - he DOES have a point.
        Wolfie2K3
        Reply Vote

      • For what it's worth.. he doesn't.

        @Wolfie2K3 This article is talking about "local access". You don't need "physical access" to gain "local access", which makes any talk about "physical access" an irrelevant straw man.

        But I suspect you knew that really.
        Zogg
        Reply Vote

      • RE: Windows 7 dinged by new zero-day vulnerability

        @SoYouSaid

        What pray tell reality are you speaking of? OSS?? HAHAHAHAH Less then 1 market share. Mac? 15% and stalled. That is the state of the desktop computing. cell phones are not computers,netbooks are not computers,the ipud is not a computer. So,what reality are you speaking of? soyousaidie?
        Stan57
        Reply Vote

    • Local attackers may sit in China

      @Loverock Davidson

      A compromised Firefox process is a "local user".
      honeymonster
      Reply Vote

      • It's obvious..

        @honeymonster .. you don't crack / hack any: i mean, why, for the life of Brian, would a cracker go through all the trouble of downloading FF on Windows when they have a perfectly good [i] open doorway [/i] built right into the OS with kernel access (hint: its also a browser and its name begins with [i]"Internet"[/i])??????

        ..Ah, i just got it, you could never bring yourself to admit that and just couldn't help your schilling, BS tendencies.

        Bad form alround ... so your score is 0/10.

        .. yawn -0-
        thx-1138_
        Reply Vote

      • What are you talking about

        @thx-1138 Nobody said anything about the cracker downloading Fx.
        rtk
        Reply Vote

      • Since you need reading comprehension classes ..

        @rtk .. i strongly suggest you try your local community college, you mug!<br><br><i>"...A compromised Firefox process is a "local user". "</i><br><br>In short, honeymonster did (see quote in italics) .. but since you're vision is failing and you're mentally challenged, i figure i needed to recap for you. Hey, that's cool, i don't mind helping the less fortunate.<br><br>But, you know, it's no wonder why he conveniently chose not to say <i>"..a compromised Internet Explorer process is a 'local user'."</i> is pretty clear .. and again since you're too dense to work it out, i'll explain it real slow like: he ... was ... flame ... baiting. (hint: Google or Wiki 'flame baiting' in case you have your head too wedged up your rear end to be able to see what that means). <br><br>So tell me <i>slow guy</i>, which version of Windows do you know of that comes with FF pre-installed after a clean install of the OS - or, indeed, built into the OS?? I mean, why else would someone .. anyone .. bring FF into a conversation about a MS product? Well i don't give a r@ts @$$ really, so you're going to have to <i>consult with</i> your honeybunny .. sorry, i mean honeymonster (and fellow psychophant) about that.<br><br>A word of advice, get a life bozo and quit with the 'smoke and mirrors' approach: you're insulting the intelligence of the other readers on ZDNet. If you can't comprehend why his reply is dubious, you're obviously as full of it as the other twerp .. pffft.<br><br>End of conversation. <br><br>(n.b. I won't be returning to this blog, so save your double-talk for someone who gives a **** about what you say)
        thx-1138_
        Reply Vote

      • Take a couple deep breaths.

        @thx-1138<br><br>"In short, honeymonster did"<br><br>No, Fx or IE would already exist on the machine. Again, nobody suggested the cracker would be downloading Fx.<br><br>"A word of advice, get a life bozo"<br><br>I'm guessing the irony is completely lost on you. Correct?

        "End of conversation.

        (n.b. I won't be returning to this blog, so save your double-talk for someone who gives a **** about what you say) "

        We can only hope you'll keep your promise.
        rtk
        Reply Vote

      • rtk tops himself...

        ...and brings cluebatism to new depths<br><br>Unbelievable. LOL... :D LOL... :D<br><br>[i]No, Fx or IE would already exist on the machine. Again, nobody suggested the cracker would be downloading Fx.[/i]<br><br>Time to sober up, rtk. Unless you're going senile. No?<br><br>How do you know FF would be on that machine? Well all know IE8 would be on there by default, but honeymonster was being cute by not including that 'little' fact. THX-1138 was being kind to you by letting you know what a idiot you are. <br><br><i>We can only hope you'll keep your promise.</i><br><br>But I'll still be around. Fat, balding PC guys like you need to be helped across the street every once in awhile.<br><br>more LOL.... :D
        ahh so
        Reply Vote

      • Ahh, didn't recognize you bs23456xx\winbsod

        figured your parents finally figured out what an antisocial piece of trash they'd raised and cut your 'net access.

        "How do you know FF would be on that machine? Well all know IE8 would be on there by default"

        How do ya figure? Every XP install out there now running IE8? Nope.

        "honeymonster was being cute by not including that 'little' fact"

        Not a fact, one can hope to run into IE, Fx, and chrome, in that order. There's no saying which versions on each machine.

        "THX-1138 was being kind to you"

        THX-1138 is a clueless troll, I just assumed it was another of your sock puppets.
        rtk
        Reply Vote

      • Still as idiotic as ever

        rtk will never change...<br><br>[i]figured your parents finally figured out what an antisocial piece of trash they'd raised and cut your 'net access.[/i]<br><br>Oh I've been around all this time, rtk. It's you that's disappeared. I figured one of the few brain cells you had left managed to have a clue and stayed away since you're old feller and can't keep up anymore. lol...<br><br><i>How do ya figure? Every XP install out there now running IE8? Nope.</i><br><br>It's installed on there by default and IE still has the biggest market share. One can assume by that that it's the culprit here. I would certainly assume it since IE8 is a lackluster, security-riddled piece of garbage, anyway. <br><br><i>Not a fact, one can hope to run into IE, Fx, and chrome, in that order. There's no saying which versions on each machine.</i><br><br>No, but honeymonster was making that distinction with his stupid statement up above. It's a good thing others like THX-1138 recognize what an obvious idiot you are and pointed that out.<br><br><i>THX-1138 is a clueless troll, I just assumed it was another of your sock puppets.</i><br><br>Don't assume anything, rtk. There's more out there besides me that think you're living on a half a deck. We don't expect a thick skull like you to see that. That would be asking too much.<br><br>more lol... :D
        ahh so
        Reply Vote

      • redacted, decided not to feed the troll

        @bsit

        You're correct, I'll try harder to ignore 'em.
        rtk
        Reply Vote

      • rtk - too late, you're already pwned

        You have been since I've been around and that's been about three years now.<br><br>And who's [i]@bsit[/i] anyway? One of the voices in your head?<br><br>lol... :D
        ahh so
        Reply Vote

    • RE: Windows 7 dinged by new zero-day vulnerability

      @Loverock Davidson <br><br>Microsoft needs to quit coming up with different iterations of their operating system, such as XP, Vista & Win7 and just name it Windows and keep patching the damn thing until it is ROCK SOLID, like hey had done with XP.
      tosh382
      Reply Vote

      • RE: Windows 7 dinged by new zero-day vulnerability

        @tosh382 agreed.

        Don't worry, it's coming. I think that in 2012 or so, Microsoft would have conceded defeat for Vista-class (Vista, Vista+ [7] and Vista++ [8]) Operating Systems.

        Am sure they will pick up the pieces (30% theoretical marketshare, 15% real) and create a XP SP5 called Windows Desktop Experience (or Legacy) which will come preinstalled on all desktop, laptop and netbooks.

        Sadly by that time, slates would have grabbed 50 or so percent of the new market and most of the new apps will be on the cloud or released on App Stores.
        cosuna
        Reply Vote

      • Put the halucinogenic mushrooms down...!

        @cosuna
        Seriously. If you think slates - such as the iPad - will take over, you've been dippin' into them funny mushrooms too much.

        First off, XP is dead. Get over it. It's not being brought back to life.

        Secondly, Windows 7 is far from being a has-been. In fact, it seems to be outselling pretty much everything that's come before it.

        Third, Slates - as demonstrated by the iPad - are extremely limited in what they can do. They may become an extension of desktop or laptop systems, but they have a LONG way to go to replace them. Keyboards and mice are far too useful interface-wise to be replaced by a virtual replacement.
        Wolfie2K3
        Reply Vote
CNET Join | Log In | Privacy | Cookies Close