Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Security researchers have discovered a serious boundary error
vulnerability in multiple versions of Microsoft’s Windows platform and warned that attackers could hijack systems via Windows Explorer and Internet Explorer (IE).
Rodrigo Gutierrez, a researcher with Trustix AS, notified Microsoft of the flaw with a warning that it could be exploited by malicious attackers to cause a buffer overflow and lead to system takeover.
Microsoft confirmed Gutierrez’s findings in an advisory and recommended users install the latest service packs for Windows XP and Windows 2000. The software giant said the hole was fixed in the service packs but independent security consultants Secunia said the vulnerability “has been confirmed on fully patched systems running Windows XP and Windows
2000.”
Secunia rates the flaw as “highly critical” and urged Windows XP and Windows 2000 users to restrict traffic in border routers and firewalls as a temporary workaround. Users could also disable the “Client for Microsoft Networks” for network cards to impact file sharing functionality.
The flaw also reportedly affects Windows 95, 98, and Me and Secunia said it was unknown whether Windows NT 4.0 and Windows 2003 were at risk.
According to the advisories, the boundary error issue is triggered via Internet Explorer and Windows Explorer when connecting to a file server.
This can be exploited to cause a buffer overflow by setting up a malicious share with an overly long name (about 300 bytes) containing no lower case
characters.
“Successful exploitation may potentially allow execution of arbitrary
code on a user’s system but requires that the user is either tricked into
connecting to a malicious file server, visit a malicious website, or follow
a specially crafted link,” Secunia warned.
The Secunia alert listed the affected Microsoft operating systems as
Windows XP Pro, Windows XP Home Edition, Windows Millenium, Windows 98
Second Edition, Windows 98, Windows 95, Windows 2000 Server, Windows 2000
Professional, Windows 2000 Datacenter Server and Windows 2000 Advanced
Server.
Affected software include IE versions 5.01, 5.5 and 6.0.
RELATED NEWS AND ANALYSIS
-
Ethics and Artificial Intelligence: Driving Greater Equality
FEATURE | By James Maguire,
December 16, 2020
-
AI vs. Machine Learning vs. Deep Learning
FEATURE | By Cynthia Harvey,
December 11, 2020
-
Huawei’s AI Update: Things Are Moving Faster Than We Think
FEATURE | By Rob Enderle,
December 04, 2020
-
Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 18, 2020
-
Key Trends in Chatbots and RPA
FEATURE | By Guest Author,
November 10, 2020
-
Top 10 AIOps Companies
FEATURE | By Samuel Greengard,
November 05, 2020
-
What is Text Analysis?
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 02, 2020
-
How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 29, 2020
-
Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 23, 2020
-
The Super Moderator, or How IBM Project Debater Could Save Social Media
FEATURE | By Rob Enderle,
October 16, 2020
-
Top 10 Chatbot Platforms
FEATURE | By Cynthia Harvey,
October 07, 2020
-
Finding a Career Path in AI
ARTIFICIAL INTELLIGENCE | By Guest Author,
October 05, 2020
-
CIOs Discuss the Promise of AI and Data Science
FEATURE | By Guest Author,
September 25, 2020
-
Microsoft Is Building An AI Product That Could Predict The Future
FEATURE | By Rob Enderle,
September 25, 2020
-
Top 10 Machine Learning Companies 2021
FEATURE | By Cynthia Harvey,
September 22, 2020
-
NVIDIA and ARM: Massively Changing The AI Landscape
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
September 18, 2020
-
Continuous Intelligence: Expert Discussion [Video and Podcast]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 14, 2020
-
Artificial Intelligence: Governance and Ethics [Video]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 13, 2020
-
IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI
FEATURE | By Rob Enderle,
September 11, 2020
-
Artificial Intelligence: Perception vs. Reality
FEATURE | By James Maguire,
September 09, 2020