Microsoft warns of bug in 64-bit Windows 7

Computerworld - Microsoft today warned users of a vulnerability in the 64-bit versions of Wndows 7 and Windows Server 2008 R2 that could be used to hijack systems.

The bug is in Windows' Canonical Display Driver, which blends the operating system's primary graphics interface, dubbed Graphics Device Interface (GDI), and DirectX to compose the desktop.

According to Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), the vulnerability affects any machine with the flashy "Aero" interface, which is the default on all but the least-expensive editions of Windows 7. Aero is an optional install on Windows Server 2008 R2.

"If exploited, it would likely cause the affected system to stop responding and restart," said Bryant in an entry on the MSRC blog. "Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)."

However, ASLR, one of the bulwarks of Windows 7's and Vista's security defenses, has been repeatedly bypassed by researchers, including two who won $10,000 cash prizes at the noted Pwn2Own hacking contest in March.

Microsoft gave the bug an exploitability index rating of "3," the lowest of the company's three-step scoring system it uses to predict the likelihood of reliable attack code appearing in the next 30 days. According to that score, Microsoft believes it's unlikely hackers will come up with an exploit in the coming month.

"We're currently developing a security update for Windows that will address the vulnerability," promised Bryant, who did not set a timetable for a patch. In lieu of a fix, users can disable Aero to protect their machines.

Attackers could exploit the vulnerability by tricking users into visiting a malicious site that hosts a rigged image file, Microsoft's advisory warned.

But an attack may require more than that seemingly simple tactic, said Andrew Storms, director of security operations at nCircle Security. "I believe what Microsoft is saying [in the advisory] is that the image viewers from Microsoft won't trigger the vulnerability, but third-party applications may."

To disable Aero, users can click Start, select Control Panel, then click on "Appearance and Personalization," Microsoft said in the advisory. Under "Personalization," users would then click "Change the Theme" and then select one of the "Basic and High Contrast Themes."

Today's advisory is not the only vulnerability not yet patched by Microsoft. A flaw in SharePoint Server 2007 was acknowledged by the company late last month, but remains unfixed.

Microsoft's next security updates are slated for release June 8.

The company won't patch this latest vulnerability that fast, said Storms. "No way," he said via instant message when asked what chance Microsoft has to ready a fix in three weeks. "They are already saying it's difficult to reproduce, [so] it will be a low priority at the moment. But the info is public, so you can bet it's getting eyeballs and things can change rapidly."

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com.

Read more about Security in Computerworld's Security Topic Center.