Miscreants have created an exploit capable of crashing Windows boxes and triggering the infamous Blue Screen of Death.

The attack relies on exploiting an unpatched vulnerability in Microsoft's implementation of SMB2 (Server Message Block), a network protocol involved in the sharing of files and printers on a network.

Attacks based on he flaw could cause all sorts of trouble in corporate environments, in particular. Fortunately, basic firewall defences are enough to dampen the threat, according to a preliminary assessment of the problem by security researchers at the Internet Storm Centre (ISC).

"The exploit needs no authentication, only file sharing enabled with one packet to create a BSOD [Blue Screen of Death]," ISC researchers warn. "We recommend filtering access to port TCP 445 with a firewall."

Five Windows specific critical patches are due out later on Tuesday. It's rather unlikely that any will plug the new BSOD vuln. Past form indicates that the release was timed to outflank Microsoft's security gnomes and provide for the maximum exploit period. ®

Related stories

• Researcher: No emergency patch for critical Windows bug (29 September 2009)
• White hats release exploit for critical Windows vuln (16 September 2009)
• MS insists bodged fix didn't spawn Windows crash risk (14 September 2009)
• Critical bug infests newer versions of Microsoft Windows (9 September 2009)
• MS fuels up five critical Windows fixes (4 September 2009)
• MS Zero-day security bug was two years in the making (14 August 2009)
• Nine MS security bulletins create busy updates workload (12 August 2009)
• Scareware package mimics Windows Blue Screen of Death (4 August 2009)
• Flash update plugs zero-day Adobe vuln (31 July 2009)
• Firefox update fixes zero-day JavaScript flaw (17 July 2009)
• Zero-day fixes star in MS Patch Tuesday (15 July 2009)
• Microsoft knew of nasty IE bug a year before attacks (9 July 2009)