Saturday, May 15, 2021

Hacker Claims First Windows 7 ‘Zero Day’

Windows 7 hasn’t even been on the street for a month, yet one hacker has
already found what he claims is a zero-day (define) vulnerability — albeit so far the result of an attack is simply to crash the new system.

Hacker Laurent Gaffié, who last August found a problem in the “release
candidate” (RC) version of Microsoft (NASDAQ: MSFT) Windows 7, announced his
find on Wednesday. He also published proof-of-concept code to
cause such crashes.

After some controversy last summer, Microsoft said that the bug Gaffié
found that time affected some late, pre-release code, but that it did not impact the
final released Windows 7 code.

The company subsequently patched the
hole
in affected operating systems in October.

Microsoft did patch a pair of “important” security holes in Windows 7 in
its October
Patch Tuesday bug fix drop. However, they were not rated rated as “critical” — the
top tier of Microsoft’s four-tier bug severity scale.

As last time, Gaffié publicized his latest find on his own blog, as well as the Full Disclosure
blog site.

The bug that Gaffié found this time is related to the same problem he
found last summer. It resides in a networking protocol called System Message
Block or SMB. While the hole he found in August was only related to version
two — known as SMB2 — the new hole affects both SMB1 and SMB2.

“Whatever your firewall is set to, you can get remotely smashed via IE
[Internet Explorer] or even via some broadcasting [NetBIOS Name
Service] tricks (no user interaction),” Gaffié said in his blog post.

The result, he said, is to cause a software kernel crash in either
Windows 7 or in Windows Server 2008 Release 2 (R2). The crash
causes a denial-of-service but doesn’t compromise the user’s PC — at least
not so far.

So far, Microsoft has said only that it’s looking into the issue.

“Microsoft is investigating new public claims of a possible
Denial-of-Service vulnerability in Windows Server Message Block. We’re
currently unaware of any attacks trying to use the claimed vulnerability or
of customer impact,” Christopher Budd, security response communications lead
at Microsoft, said in an e-mail.

“Once we’re done investigating, we will take appropriate action to help
protect customers,” Budd added.

Microsoft only earlier this week patched several critical bugs when it
released its November Patch Tuesday fixes.

Article courtesy of InternetNews.com.

Similar articles

Latest Articles

How IBM has Changed...

Think is IBM’s big annual conference, and again this year, it was digital. I’m noticing a sharp quality difference in shows like this where...

Database-Tuning Platform Launches and...

PITTSBURGH — A team out of Carnegie Mellon University is launching its automatic database-tuning product today with the help of $2.5 million in funding.   OtterTune,...

Top 10 Professional Services...

Professional services automation (PSA) software aims to offer service-based companies most of the software they will need to run their businesses in one package....

What is Data Aggregation?

Data aggregation is the process where raw data is gathered and presented in a summarized format for statistical analysis. The data may be gathered...