Original URL: http://www.theregister.co.uk/2013/01/08/nvidia_security_update/
Nvidia fixes hole that turns PCs into remote-control toys for hackers
More importantly, new driver boosts Call of Duty graphics
Posted in Security, 8th January 2013 12:57 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Nvidia has plugged a critical flaw in its graphics card software that allowed hackers to gain "super-user" access to vulnerable PCs over a network.
The Nvidia GeForce display driver update, version 310.90, also features a number of other bug fixes and performance upgrades.
"The vulnerability allows a remote attacker with a valid domain account to gain super-user access to any desktop or laptop running the vulnerable service," HD Moore, the developer of Metasploit and chief security officer at Rapid7, told [1] SecurityWeek.
"This flaw also allows an attacker (or rogue user) with a low-privileged account to gain super-access to their own system, but the real risk to enterprises is the remote vector," he added.
The critical privilege elevation flaw was discovered [2] by UK security researcher Peter Winter-Smith.
The driver update can be downloaded here [3]. The accompanying summary of the update mentions a "security update for the Nvidia Display Driver service (nvvsvc.exe)" in one sentence but concentrates on claimed performance improvements for gamers, particularly fans of Call of Duty: Black Ops 2 and Assassin's Creed III.
More details of the update can be found in a bumper 67-page release notes document on Nvidia's website (PDF [4]). ®