Slashdot Mirror

← Back to Stories (view on slashdot.org)

Newly-Found Windows Bug Affects All Versions Since NT

Posted by Soulskill on from the staying-power dept.

garg0yle writes "A researcher has found a security bug that could allow privilege escalation in Windows. Nothing new there, right? Well, this affects the Virtual DOS Machine, found in every 32-bit version of Windows all the way back to Windows NT. That's 17 years worth of Windows and counting. 'Using code written for the VDM, an unprivileged user can inject code of his choosing directly into the system's kernel, making it possible to make changes to highly sensitive parts of the operating system. ... The vulnerability exists in all 32-bit versions of Microsoft OSes released since 1993, and proof-of-concept code works on the XP, Server 2003, Vista, Server 2008, and 7 versions of Windows, Ormandy reported.'"

8 of 393 comments (clear)

  1. How do we know it's not already in use? by jollyreaper · · Score: 5, Interesting

    Every time I read about one of these long-undiscovered instant pwn bugs, I always have to wonder if there's someone sitting deep underground in an NSA computer center saying "Well shit, looks like we'll not be using that exploit anymore."

    Is this a hole nobody knew about or a hole nobody but the people who knew about it knew about, and those people weren't talking?

    --
    Kwisatz Haderach
    Sell the spice to CHOAM
    This Mahdi took Shaddam's Throne
    1. Re:How do we know it's not already in use? by Skratchez · · Score: 5, Interesting

      My first thoughts exactly. I've always assumed any Windows PC I'm using could have been rooted long ago to an extent that no security tool could detect or repair it. I guess I'm just paranoid, I should really just switch to a Linux distro and start compiling my own kernels. As if I wouldn't screw that up too.

    2. Re:How do we know it's not already in use? by think_nix · · Score: 5, Interesting

      funny how the security researcher (TFA) works at google , and now with the google china scenario this bug is now getting press when it was reported back in june 2009 , and still has not been fixed.
      Wonder if all these new MS & IE bugs exploits being made known through google are due to lack of solidarity on some issues between google / ms ?

    3. Re:How do we know it's not already in use? by Xest · · Score: 4, Interesting

      More likely Google discovered this one as a result of a security audit in the light of the Chinese attacks against them.

      Interestingly though, the parent may have a point, it could be that this one of the exploits the Chinese used internally at Google precisely because they have known about it so long.

      But still, who knows.

    4. Re:How do we know it's not already in use? by Chatterton · · Score: 4, Interesting

      If you are really paranoid, you will write yourself your own C compiler or else this could happen:
      http://scienceblogs.com/goodmath/2007/04/strange_loops_dennis_ritchie_a.php

    5. Re:How do we know it's not already in use? by sconeu · · Score: 4, Interesting

      You've got to build your own toolchain, too.... from the bare metal.

      Reflections on Trusting Trust.

      And I guess you have to trust the CPU not to have backdoors, too...

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
  2. You can review Windows OS code. by 140Mandak262Jamuna · · Score: 4, Interesting

    You will never be able to review the source code of your windows OS.

    All you have to be is Chinese Government. That is all. You think the Google hack was found by relentless probing of defenses of the WinOS? Or did they have to just grep through the WinOS source code for things like strcpy()?

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
  3. exploit as published doesn't work by chentiangemalc · · Score: 4, Interesting

    I've tested the exploit in virtual machine in Windows 7 x32 and Windows XP SP3 and it doesn't work. These are default installs of OS with no config changes. When run in Windows 7 x32 as Administrator it did cause BSOD. Running as standard user it did nothing, the process supposed to have escalated priviliges did not. anybody else found it working?