Google Researcher Publishes Unpatched Windows 8.1 Security Vulnerability

← Back to Stories (view on slashdot.org)

Google Researcher Publishes Unpatched Windows 8.1 Security Vulnerability

Posted by samzenpus on Wednesday December 31, 2014 @07:10AM from the protect-ya-neck dept.

An anonymous reader writes "Google's security research database has after a 90 day timeout automatically undisclosed a Windows 8.1 vulnerability which Microsoft hasn't yet patched. By design the system call NtApphelpCacheControl() in ahcache.sys allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext(). Long story short, the aforementioned function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator. It hasn't been fully verified if Windows 7 is vulnerable. For a passer-by it is also hard to tell whether Microsoft has even reviewed the issue reported by the Google researcher. The database has already one worried comment saying that automatically revealing a vulnerability just like that might be a bad idea."

12 of 129 comments (clear)

Min score:

Reason:

Sort:

90 days to fix by Anonymous Coward · 2014-12-31 07:15 · Score: 5, Insightful

"The database has already one worried comment saying that automatically revealing a vulnerability just like that might be a bad idea."
Really? They had 90 days to fix this. That is plenty of time.
1. Re: 90 days to fix by O('_')O_Bush · 2014-12-31 07:52 · Score: 3, Insightful
  
  That really isn't Google or our problem. Attackers aren't going to politely wait for Microsoft to fix issues like this, and Microsoft won't fix issues like this unless they are pressed to. And this brings up the glaring flaw with closed source products. If a third party flagged an issue in an open source product, any user that is concerned enough could potentially fix it or patch their own systems themselves. With closed source, we have to wring our hands and wait for someone at Microsoft to care enough to fix it.
  
  --
  while(1) attack(People.Sandy);
2. Re:90 days to fix by hawguy · 2014-12-31 10:21 · Score: 4, Insightful
  
  I think after 90 days, Miccrosoft should be held criminally accountable to every single user, worldwide. Applies to "dropped" support products people may be forced to continue using for various reasons (embedded, integrated systems, lack of budget to upgrade to new OS/hardware) .. think Win 7 and even XP.
  No one is "forced" to continue using MS products -- unless they signed a support contract for extended support, MS can't be held responsible for supporting legacy systems indefinitely. If you don't want to be stuck with a system running an unsupported operating system, then you can sign (and pay for) a long-term support contract throughout the life of your product, you can get the source (harder with closed-source products, but not impossible with enough money) and support it yourself, or you can plan on upgrading your product hardware/software to stay with currently supported software.
  I fail to see how Microsoft has any responsibility to support software for a hardware product that a manufacturer has decided not to keep current enough to run supported software. If the old HVAC system in your building relies on Windows 3.1 to keep it running, then maybe you ought to go after the vendor that sold it to you, if a replacement for the fan motor in your HVAC system is no longer available, you'd either retrofit to accept a current motor, or just upgrade the entire system, which is what you should do when the computer that controls it is no longer supported by current software.
Grammar police alert by Anonymous Coward · 2014-12-31 07:16 · Score: 4, Insightful

Undisclosed?
Ha ha ha by drinkypoo · 2014-12-31 07:27 · Score: 4, Insightful

The database has already one worried comment saying that automatically revealing a vulnerability just like that might be a bad idea.
Not automatically revealing a vulnerability just like that would be an even worse idea. Sometimes, there is no good idea, just the best of bad options.

--
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
1. Re:Ha ha ha by nobuddy · 2014-12-31 09:06 · Score: 5, Informative
  
  People used to wait on Microsoft to fix before revealing. As a result, Microsoft didn't bother to fix anything until it became a problem in the wild.
  Once people started giving deadlines and sticking to them, Microsoft's patch response time became orders of magnitude faster. Simply put, they will do ONLY what they are forced to do.
2. Re:Ha ha ha by Dutch+Gun · 2014-12-31 10:57 · Score: 5, Interesting
  
  Microsoft got serious about security a decade ago when it became obvious that their customers cared about security, and made it a company-wide priority. They've taken reported security exploits seriously for a very long time now, and disclosing any vulnerability before a patch is deployed is absolutely irresponsible. It's arrogant as hell for Google to decide that 90 days is long enough, thank you. Recently, though, that seems to be nothing new for Google, as they now seem fairly comfortable dictating timelines to the rest of the internet about all sorts of recent security-related issues.
  Keep in mind that if Microsoft screws up a patch (something that's happened a few times recently), it causes very real problems for a massive number of people... much more so than security issues that may not have even been seen in the wild yet (I saw no indication in the linked article that this was the case) - but now probably will since the attack is known. If that happens, Google is as culpable for any harm done as Microsoft is because of their disclosure policy.
  Sorry if I sound like an MS shill, but Google is really starting to piss me off with their high-handed attitude on stuff like this lately.
  
  --
  Irony: Agile development has too much intertia to be abandoned now.
Re:Poor choices to use proprietary cause this! by halivar · 2014-12-31 07:43 · Score: 3

While non-proprietary software might be imperfect at least the end-user isn't restricted from fixing bugs when they occur.
The average Linux user does not fix his own kernel bugs. End-users are restricted, if not by closure, then by competence and knowledge.
Re:Poor choices to use proprietary cause this! by jones_supa · 2014-12-31 08:02 · Score: 4, Insightful

While non-proprietary software might be imperfect at least the end-user isn't restricted from fixing bugs when they occur.
It's only a theoretical possibility. Even if the fix would not consist of much code, getting familiar with the codebase and then designing the proper fix takes ages.
People talking about the wonders of open source should do an experiment where they personally actually fix some little thing in one open source project.
Re:A victim of applications and history by ceoyoyo · 2014-12-31 08:05 · Score: 4, Informative

You should type "man sudo" sometime.
Re:Let's be honest by gatkinso · 2014-12-31 08:30 · Score: 4, Informative

For a long time I thought that... then I actually tried Windows 8.1.
It is not bad actually, and far better than 7 in every way that I can tell.

--
I am very small, utmostly microscopic.
Re:Let's be honest by gatkinso · 2014-12-31 09:43 · Score: 4, Interesting

Boots faster. Is more stable. Uses less memory resources. Windows networking seems to work better. Seemless integration with the kids XBox.
I seem to have much more luck developing drivers on 8.1 as well - far less error check screens (more a function of me learning the DDK), also at the user level ETW seems rather more robust. Windbg also seems to be more stable when running on 8.1.
Also, I like the UI better (on the desktop) - I largely ignore the metro screen or whatever it is called.

--
I am very small, utmostly microscopic.