Feeds

Creaky old Windows flaw rises, divides doommongers

It's either no biggie, or hot buttered death

Beginner's guide to SSL certificates

A new Windows-based denial of service attacks reportedly exploits a 10-year old OS flaw to crash vulnerable systems.

Independent security experts downplay the likely impact of the bug even though 2X Software, the virtual computing firm that discovered the bug, is talking up its supposed seriousness. Versions of Windows from the latest Windows 7/Server 2008 versions down to Windows 2000/Server 2003 are affected by the flaw, according to 2X.

2X, which is not well known in the world of information security research, issued a press release over its discovery on Wednesday billing it "one of the biggest security vulnerabilities in the Windows OS for many years".

Beyond saying the bug can result in a blue screen and system reboot, 2X's release is scant on details. Independent security experts are suspicious of reading too much into 2X's claims.

"Given the immediate explanation it doesn't seem likely that we would even consider it a vulnerability - and if we do, then it only seems to be a local denial-of-service," said Thomas Kristensen, CSO of security notification firm Secunia. "This means that the most 'critical' scenario is where users [have] already got legal access to a terminal server or other multi user system which they can crash."

"If you can already run code on a system then you could do a zillion more useful things than crash it," adds Kristensen. "There are also many ways in which to crash a system if you can run code. Thus it is hard to see what's new here, except that blue screen of death is quite rare these days unless you have malware or a buggy hardware driver."

2X, which reckons that exploiting the flaw would be straightforward, has notified Microsoft about the vulnerability.

"With just a few lines of code an application can be created that will crash the whole Windows system," it said. "This flaw can be easily used inside malicious applications to generate a Denial of Service attack. The problem can be easily corrected within the OS code by validating the arguments passed to the API."

The warning from 2X follows just weeks after UK security firm PrevX wrongly blamed a Black Screen of Death problem on a recent Windows update back in December. Blue screen problems some experienced after applying Microsoft updates earlier this month were later put down to the presence of a rootkit on affected systems.

With this recent history in mind, it's perhaps best to wait for Microsoft's response rather than rushing to judgement on 2X's advisory press release. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.