Microsoft warns of bug in 64-bit Windows 7
Downplays threat with low exploit rating, recommends disabling Aero
Computerworld - Microsoft today warned users of a vulnerability in the 64-bit versions of Wndows 7 and Windows Server 2008 R2 that could be used to hijack systems.
The bug is in Windows' Canonical Display Driver, which blends the operating system's primary graphics interface, dubbed Graphics Device Interface (GDI), and DirectX to compose the desktop.
According to Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), the vulnerability affects any machine with the flashy "Aero" interface, which is the default on all but the least-expensive editions of Windows 7. Aero is an optional install on Windows Server 2008 R2.
"If exploited, it would likely cause the affected system to stop responding and restart," said Bryant in an entry on the MSRC blog. "Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)."
However, ASLR, one of the bulwarks of Windows 7's and Vista's security defenses, has been repeatedly bypassed by researchers, including two who won $10,000 cash prizes at the noted Pwn2Own hacking contest in March.
Microsoft gave the bug an exploitability index rating of "3," the lowest of the company's three-step scoring system it uses to predict the likelihood of reliable attack code appearing in the next 30 days. According to that score, Microsoft believes it's unlikely hackers will come up with an exploit in the coming month.
"We're currently developing a security update for Windows that will address the vulnerability," promised Bryant, who did not set a timetable for a patch. In lieu of a fix, users can disable Aero to protect their machines.
Attackers could exploit the vulnerability by tricking users into visiting a malicious site that hosts a rigged image file, Microsoft's advisory warned.
But an attack may require more than that seemingly simple tactic, said Andrew Storms, director of security operations at nCircle Security. "I believe what Microsoft is saying [in the advisory] is that the image viewers from Microsoft won't trigger the vulnerability, but third-party applications may."
To disable Aero, users can click Start, select Control Panel, then click on "Appearance and Personalization," Microsoft said in the advisory. Under "Personalization," users would then click "Change the Theme" and then select one of the "Basic and High Contrast Themes."
Today's advisory is not the only vulnerability not yet patched by Microsoft. A flaw in SharePoint Server 2007 was acknowledged by the company late last month, but remains unfixed.
Microsoft's next security updates are slated for release June 8.
The company won't patch this latest vulnerability that fast, said Storms. "No way," he said via instant message when asked what chance Microsoft has to ready a fix in three weeks. "They are already saying it's difficult to reproduce, [so] it will be a low priority at the moment. But the info is public, so you can bet it's getting eyeballs and things can change rapidly."
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts