Slashdot Mirror
Newly-Found Windows Bug Affects All Versions Since NT
garg0yle writes "A researcher has found a security bug that could allow privilege escalation in Windows. Nothing new there, right? Well, this affects the Virtual DOS Machine, found in every 32-bit version of Windows all the way back to Windows NT. That's 17 years worth of Windows and counting. 'Using code written for the VDM, an unprivileged user can inject code of his choosing directly into the system's kernel, making it possible to make changes to highly sensitive parts of the operating system. ... The vulnerability exists in all 32-bit versions of Microsoft OSes released since 1993, and proof-of-concept code works on the XP, Server 2003, Vista, Server 2008, and 7 versions of Windows, Ormandy reported.'"
64 bit referrers to the addressing space. If you have under 32 bit addressing of RAM, 64 bit will be slower.
Read up.
Linux has it's own version of such bugs. Yes, even with the 'many eyes' looking at the source, it does happen, F/OSS is no panacea.
From http://news.zdnet.com/2100-9595_22-332141.html
A hole has been found in Linux kernel versions stretching back eight years that is 'as trivial as it can get to exploit', according to the Google employees who discovered it.
Julien Tinnes and Tavis Ormandy, the security researchers who discovered the vulnerability, have already issued a patch for the flaw. According to a blog post written by Tinnes on Thursday, the hole "affects all 2.4 and 2.6 kernels since 2001 on all architectures", and is "the public vulnerability affecting the greatest number of kernel versions".
This space for rent.
Yet another reason people need to abandon 32-bit OSs. Seriously. What's the point of using half the power of your CPU?
I only have 32-bit hardware, you insensitive clod!
Escher was the first MC and Giger invented the HR department.
Yea such exploits do not happen in Linux.
http://news.zdnet.com/2100-9595_22-332141.html
http://www.theregister.co.uk/2008/05/21/massive_debian_openssl_hangover/
This space for rent.
Any code can potentially be compromised. The difference here is that anybody can audit or fix the Linux code, and many people and organisations have and do. So yeah, you're safer using Linux than Windows in that regard.
I am literally 3000 tokens away from the chaotic crossbow --Stephen
it looks Like one more reason to switch to 64bit to me. I have been using 64bit since Vista. Now I am glad I made the switch. and since the oem keys for vista and 7 are good for both the 32bit and 64bit versions the only excuse for not going 64bit is laziness (assuming you have a 64bit processor) I have yet to find a 32bit program that doesn't run on my 64bit machine.
there are 10 types of people in this world, those who read binary and those who don't. which are you!
While its true that there will be some overhead from the increased address size, there is however something significant to be said about the increase in the number of General Purpose Registers in the cpu that you get access to when using x86_64 rather than just x86. It is very important to realize that x86 being such a register starved architecture has significant gains from the doubling of the number of registers available to a program, this can mean that many more loops can have some or most of their main variables in the extremely fast registers rather than having to go out and fetch them from memory on each use. Even with a large fast cache next to the CPU you still cannot beat the performance gains from being able to have twice as many things in GPR.
Windows 7 64-bit is not vulnerable to this, and thats the version that is pushing heavily to OEMs and companies.
This space for rent.
Assuming, of course, that you're not running any binary blobs like, for example, the nVidia driver that had a remote exploit allowing an attacker to gain kernel privilege and wasn't fixed two years after it was first reported. No one outside of nVidia could audit the code and fix it, but other people (like the person who reported it) had found it and were able to exploit it.
I am TheRaven on Soylent News
That's not an equivalent bug, because it affects all architectures. This bug is in some architecture-specific code for running the VM86 mode on IA32 chips. It doesn't affect NT 4 on Alpha, PowerPC, or MIPS, or any more recent versions on x86-64 or IA64.
I am TheRaven on Soylent News
The same thing "could" happen in the Linux kernel, true. But that does not mean it "isn't safer" to use linux over windows.
You will never be able to review the source code of your windows OS. You "can" do so in linux. For a sufficiently small linux distro, you could inspect the code yourself. There used to be linux distro's that fit on a single 1.44 mb floppy, I have had a hard time finding them now, smallest I can find recently is about 2mb. If you are an expert, thats small enough to review in a couple years. In a modern distro, it would be impossible for an individual to vet the entire code base, it would not be impossible for an organized, determined group of a few thousand experts to do so. I believe that the NSA does just this with selinux, or at least thats the claim.
The point I am making is that under the open development model, every change to the code is reviewed and inspected by several different people before it is included, this may not happen in a closed environment. Even after a change is approved, implemented and distributed, the availability of the source to everyone makes it more likely that such flaws are noted soon and then fixed quickly.
Vulnerability applies to 32-bit Microsoft Windows operating systems with Windows NT 3.5 heritage.
Vulnerability arises from ancient coding or design flaws in the MS-DOS execution subsystem. This subsystem is not present in 64-bit Windows OSs.
The workaround is to disable the MS-DOS subsystem.
Great article at the SANS Institute Internet Storm Center: http://isc.sans.org/diary.html?storyid=8023. This includes links to Youtube videos on how to use Windows Group Policy tools to disable this subsystem.
However, once you do this, you won't be able to run 16-bit DOS-based software, so if you really need that you may have to wait for a patch. Or build a dedicated DOS machine, where at least you'll have no illusions of security. (Cynics would say this is true of any MS operating system, but I leave that debate to others.)
Welcome to the Panopticon. Used to be a prison, now it's your home.
> Guess I'm glad I run 64bit.
Why do you assume that you are not subject to a different but equally appalling set vulnerabilities? The same people wrote 64bit Windows.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
You should have probably read the link. Buffer overflow allowed code to run as root (because the nvidia drivers do)
Relative to a 17-year latency period, yeah, 7 months is new-found. And full disclosure was new as of yesterday. To everyone but the discoverer and the OS vendor, that makes it new.
To crib some TV network's advertisement, "It's a rerun, but it's new to you!"
Welcome to the Panopticon. Used to be a prison, now it's your home.
Yes, but Linux is secure the same way OS X is secure - nobody cares enough to exploit it.
Linux has it's own version of such bugs. Yes, even with the 'many eyes' looking at the source, it does happen, F/OSS is no panacea.
From http://news.zdnet.com/2100-9595_22-332141.html
A hole has been found in Linux kernel versions stretching back eight years that is 'as trivial as it can get to exploit', according to the Google employees who discovered it.
Julien Tinnes and Tavis Ormandy, the security researchers who discovered the vulnerability, have already issued a patch for the flaw. According to a blog post written by Tinnes on Thursday, the hole "affects all 2.4 and 2.6 kernels since 2001 on all architectures", and is "the public vulnerability affecting the greatest number of kernel versions".
Eight year is a pretty 'good' record, but Windows still wins by 7 more (NT3.5 released in 1994, more or less the time of release of Linux 1.0). Also notice that then Linux bug was fixed almost contextually with its report, whereas the one this article is about has not not been fixed 6 months+ after the report was acknowledged. This is where open source wins.
"I'm never quite so stupid as when I'm being smart" (Linus van Pelt)
You must be new here. Negative media exposure for Microsoft on /. is pretty much the norm.
Cue the "cue the" comments in 3, 2, 1, 0, 65535, 65534, ...
You will notice that that error was found and corrected fairly quickly
Actually it wasn't found until 2 years after the code was originally committed.
Nope. There was a published exploit straight to remote root from web page view.
WOW is for 16-bit Windows apps, not DOS apps.
there's no possible way to remotely exploit this (outside of another vulnerability)
Your caveat says more than the rest of your post. Considering how many external-facing exploits exist, and how many probably remain undiscovered, I wouldn't be surprised if this one is often used to root a machine once it's been compromised. You can clean infected files, but only if you can detect them, and they're separate and distinct from your files.
One external-facing exploit can wreck havoc before it's fixed or the machine's reformatted. Add this one into play, and the operator simply won't realize the machine's compromised.
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."