Feeds

Creaky old Windows flaw rises, divides doommongers

It's either no biggie, or hot buttered death

Top 5 reasons to deploy VMware with Tegile

A new Windows-based denial of service attacks reportedly exploits a 10-year old OS flaw to crash vulnerable systems.

Independent security experts downplay the likely impact of the bug even though 2X Software, the virtual computing firm that discovered the bug, is talking up its supposed seriousness. Versions of Windows from the latest Windows 7/Server 2008 versions down to Windows 2000/Server 2003 are affected by the flaw, according to 2X.

2X, which is not well known in the world of information security research, issued a press release over its discovery on Wednesday billing it "one of the biggest security vulnerabilities in the Windows OS for many years".

Beyond saying the bug can result in a blue screen and system reboot, 2X's release is scant on details. Independent security experts are suspicious of reading too much into 2X's claims.

"Given the immediate explanation it doesn't seem likely that we would even consider it a vulnerability - and if we do, then it only seems to be a local denial-of-service," said Thomas Kristensen, CSO of security notification firm Secunia. "This means that the most 'critical' scenario is where users [have] already got legal access to a terminal server or other multi user system which they can crash."

"If you can already run code on a system then you could do a zillion more useful things than crash it," adds Kristensen. "There are also many ways in which to crash a system if you can run code. Thus it is hard to see what's new here, except that blue screen of death is quite rare these days unless you have malware or a buggy hardware driver."

2X, which reckons that exploiting the flaw would be straightforward, has notified Microsoft about the vulnerability.

"With just a few lines of code an application can be created that will crash the whole Windows system," it said. "This flaw can be easily used inside malicious applications to generate a Denial of Service attack. The problem can be easily corrected within the OS code by validating the arguments passed to the API."

The warning from 2X follows just weeks after UK security firm PrevX wrongly blamed a Black Screen of Death problem on a recent Windows update back in December. Blue screen problems some experienced after applying Microsoft updates earlier this month were later put down to the presence of a rootkit on affected systems.

With this recent history in mind, it's perhaps best to wait for Microsoft's response rather than rushing to judgement on 2X's advisory press release. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.