Windows 7 zero-day reported
Summary: A security researcher said there is a zero-day vulnerability affecting Windows 7 and Vista. The alleged flaw could allow an attack that could cause the "Blue Screen of Death."
The flaw in Windows 7 could allow an attack which would cause a critical system error, or "Blue Screen of Death", according to researcher Laurent Gaffie.
Gaffie wrote in his blog that the flaw lies in a Server Message Block 2 (SMB2) driver.
"SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionality," wrote Gaffie in a blog post on Monday.
Gaffie said he had contacted Microsoft. Comments on his blog by other users said that the flaw could lead not only to denial of service, but could also lead to remote code execution.
Computer security publication 'The H' wrote on Tuesday that its German sister publication had tested the proof-of-concept code, and that while the exploit had caused a reboot on Vista, the exploit had not worked on Windows 7.
Metasploit creator HD Moore said in a tweet on Tuesday that an SMB bug appeared to have been introduced into Vista SP1. Coder Josh Goebel said in a blog post that he had added the exploit code to Metasploit.
Microsoft had not responded to a request for comment at the time of writing.
This article was originally posted on ZDNet UK.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Oh my god, a piece of software has an error!
RE: Windows zero-day reported
Daily?
Hmmmm...what was yesterady's? Sunday's? Saturday's?
Oh my god, an exaggeration on a blog!
[/b]
RE: Windows zero-day reported
Wait a minute. False alarm. My home Computers are all Ubuntu linux base.
It's your assertion Linux doesn't have vulnerabilities?
You are right
Indeed
"The views expressed here are mine and do not reflect the official opinion of my employer or the organization through which the Internet was accessed."
Of course
It also makes an incorrect assertion that it is only hobby coders are fixing the linux Kernel vulnerabilities. Several companies have an interest in the kernel and actually pay their own coders to spend time submitting fixes. True, there may be less predictability of patch delivery (knowing it will be on a Tuesday but not necessarily predictability of which Tuesday).
I have been trying to locate recent studies which compare average time to deliver patches but have not found one that is not slanted to one side or the other to a large extent (ie MS funded or a pro-linux site). If any would have a comparison, that would be beneficial.
Really?
If I'm not mistaken it has sometimes taken MS month to fix vulnerabilities. Years even...
Need we?
"The views expressed here are mine and do not reflect the official opinion of my employer or the organization through which the Internet was accessed."
Known vulnerabilities
The vulnerability you describe was fixed same day.
Nope. If anything, stuff in Linux gets fixed faster than Windows.
Your point being? nt
Point being you don't get what you pay for you nowadays.
[/b]
That's a really stupid interpretation.
worse or at best even, and costs hundreds of
dollars.
That one
"The views expressed here are mine and do not reflect the official opinion of my employer or the organization through which the Internet was accessed."
Nope
Stupid assertion...
Faggot