Feeds

Creaky old Windows flaw rises, divides doommongers

It's either no biggie, or hot buttered death

The Power of One eBook: Top reasons to choose HP BladeSystem

A new Windows-based denial of service attacks reportedly exploits a 10-year old OS flaw to crash vulnerable systems.

Independent security experts downplay the likely impact of the bug even though 2X Software, the virtual computing firm that discovered the bug, is talking up its supposed seriousness. Versions of Windows from the latest Windows 7/Server 2008 versions down to Windows 2000/Server 2003 are affected by the flaw, according to 2X.

2X, which is not well known in the world of information security research, issued a press release over its discovery on Wednesday billing it "one of the biggest security vulnerabilities in the Windows OS for many years".

Beyond saying the bug can result in a blue screen and system reboot, 2X's release is scant on details. Independent security experts are suspicious of reading too much into 2X's claims.

"Given the immediate explanation it doesn't seem likely that we would even consider it a vulnerability - and if we do, then it only seems to be a local denial-of-service," said Thomas Kristensen, CSO of security notification firm Secunia. "This means that the most 'critical' scenario is where users [have] already got legal access to a terminal server or other multi user system which they can crash."

"If you can already run code on a system then you could do a zillion more useful things than crash it," adds Kristensen. "There are also many ways in which to crash a system if you can run code. Thus it is hard to see what's new here, except that blue screen of death is quite rare these days unless you have malware or a buggy hardware driver."

2X, which reckons that exploiting the flaw would be straightforward, has notified Microsoft about the vulnerability.

"With just a few lines of code an application can be created that will crash the whole Windows system," it said. "This flaw can be easily used inside malicious applications to generate a Denial of Service attack. The problem can be easily corrected within the OS code by validating the arguments passed to the API."

The warning from 2X follows just weeks after UK security firm PrevX wrongly blamed a Black Screen of Death problem on a recent Windows update back in December. Blue screen problems some experienced after applying Microsoft updates earlier this month were later put down to the presence of a rootkit on affected systems.

With this recent history in mind, it's perhaps best to wait for Microsoft's response rather than rushing to judgement on 2X's advisory press release. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.