SHARE

Hacker Claims First Windows 7 ‘Zero Day’

Windows 7 hasn’t even been on the street for a month, yet one hacker has already found what he claims is a zero-day (define) vulnerability — albeit so far the result of an attack is simply to crash the new system. Hacker Laurent Gaffié, who last August found a problem in the “release candidate” (RC) […]

Written By

SJJ

Stuart J. Johnston

Nov 13, 2009

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Windows 7 hasn’t even been on the street for a month, yet one hacker has
already found what he claims is a zero-day (define) vulnerability — albeit so far the result of an attack is simply to crash the new system.

Hacker Laurent Gaffié, who last August found a problem in the “release
candidate” (RC) version of Microsoft (NASDAQ: MSFT) Windows 7, announced his
find on Wednesday. He also published proof-of-concept code to
cause such crashes.

After some controversy last summer, Microsoft said that the bug Gaffié
found that time affected some late, pre-release code, but that it did not impact the
final released Windows 7 code.

The company subsequently patched the
hole in affected operating systems in October.

Microsoft did patch a pair of “important” security holes in Windows 7 in
its October
Patch Tuesday bug fix drop. However, they were not rated rated as “critical” — the
top tier of Microsoft’s four-tier bug severity scale.

As last time, Gaffié publicized his latest find on his own blog, as well as the Full Disclosure
blog site.

The bug that Gaffié found this time is related to the same problem he
found last summer. It resides in a networking protocol called System Message
Block or SMB. While the hole he found in August was only related to version
two — known as SMB2 — the new hole affects both SMB1 and SMB2.

“Whatever your firewall is set to, you can get remotely smashed via IE
[Internet Explorer] or even via some broadcasting [NetBIOS Name
Service] tricks (no user interaction),” Gaffié said in his blog post.

The result, he said, is to cause a software kernel crash in either
Windows 7 or in Windows Server 2008 Release 2 (R2). The crash
causes a denial-of-service but doesn’t compromise the user’s PC — at least
not so far.

So far, Microsoft has said only that it’s looking into the issue.

“Microsoft is investigating new public claims of a possible
Denial-of-Service vulnerability in Windows Server Message Block. We’re
currently unaware of any attacks trying to use the claimed vulnerability or
of customer impact,” Christopher Budd, security response communications lead
at Microsoft, said in an e-mail.

“Once we’re done investigating, we will take appropriate action to help
protect customers,” Budd added.

Microsoft only earlier this week patched several critical bugs when it
released its November Patch Tuesday fixes.

Article courtesy of InternetNews.com.