Windows 7, Vista Zero-Day Brings BSoD
Next news- Email |
- Print |
- Comments (32) |
- Share
An exploit in the SRV2.SYS driver can allow an attacker to remotely crash a PC with Windows 7 or Windows Vista.
Security researcher Laurent Gaffie reports that a zero-day vulnerability affecting both Windows 7 and Vista could allow an attacker to invoke the dreaded Blue Screen of Death. Apparently there is a flaw in a Server Message Block 2 (SMB2) driver that's causing the critical system failure. Gaffie's blog, posted yesterday, says that the driver fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionality. Windows Server 2008 may also be affected by the exploit.
"An attacker can remotely crash any Vista/Windows 7 machine with SMB enabled," the blog reads. Apparently, Windows XP and 2000 are not affected, as they do not have the SRV2.SYS driver. Gaffie provides a proof of concept sample, and suggests that users close the SMB ports by un-ticking the boxes for file and printer access in the firewall settings until Microsoft releases a patch. Gaffie also contacted Microsoft, however no reply has been provided as of this writing.
The H Security expands on the problem's definition, reporting that the driver crashes when the header of the "Process Id High" field contains an ampersand. The attack can travel through port 445 of the target system, and does not require authentication. The H Security also said that an exploit written in Python is already available.
The site's German associate actually tested the exploit, and succeeded in remotely rebooting a Windows Vista system. The test had no affect on the Windows 7 machine. According to ZDNet, Security researcher (and author of Metasploit) HD Moore suggests in this tweet that a SMB bug may have already been introduced into Vista SP1.
Source : Tom's Hardware US
Sponsored links
Best offers
|
Windows 7 Professional (Full Product) | $299.99 Dell Small Business More info |
|
Office 2007 Home and Student (Full... | $119.95 Newegg.com More info |
|
Windows 7 Home Premium (Upgrade) | $119.99 Dell Small Business More info |
|
Windows 7 Ultimate (Full Product) | $319.99 Dell Small Business More info |
|
Norton Internet Security 2010 - 3 Users | $69.99 Dell Small Business More info |
Troubleshooting Windows 7 With Microsoft's Built-In Tools
Windows 7 is more stable and responsive than Vista, but no operating system is perfect (the same goes for the drivers and apps running on it). We show you a suite of tools built into Microsoft’s shiny new OS to help you troubleshoot your Windows 7 issues. Read More
-
Quick Look: Notebook Performance With Windows XP, Vista, And 7
Windows 7 is here, and we've already established that it tastes great, is less filling, and performs well. But do you want it on your notebook? We compared the performance and battery life of Windows XP, Vista, and 7 on an upper-mainstream mobile system. Read More
-
Windows 7 And Windows Vista: Performance Compared
Microsoft is hyping Windows 7 as the operating system that everyone should adopt. We'd already done a bit of benchmarking in the new OS, but we revisit a longer list of tests today, including more real-world tasks, like boot-up, hibernate, and shutdown. Read More
BSODs are to Windows as the spinning beach ball of death is to Mac OSX
Someone should invent a BSOD vista gadget
Mine would be stuck on "0"!
I'm still waiting to get a BSOD on my cell phone running Win Mobile, I'd quite possibly laugh my ass off. Though I'd be quite pissed if I lost data
Sorry, but even the pentagon can be hacked, so why Windows would be more secure? I don't see the point in trying to spoil win7 launch party...
@vladtepes: Actually, Macs have kernal panics as well - basically a black screen saying "Your computer has crashed" and no useful data (well duh it crashed
). My dad's Macbook Pro gets one of those every month or two at least.
@vladtepes: Actually, Macs have kernal panics as well - basically a black screen saying "Your computer has crashed" and no useful data (well duh it crashed ). My dad's Macbook Pro gets one of those every month or two at least.
Yes I know about that, but the "beachball of death" is much funnier than "kernel panic"
Sweet, has this been patched yet?
No? OH SHI-
BSODs are to Windows as the spinning beach ball of death is to Mac OSX
actually
BSODs are to Windows as the Kernel Panic is to Mac OSX
@vladtepes: Actually, Macs have kernal panics as well - basically a black screen saying "Your computer has crashed" and no useful data (well duh it crashed ). My dad's Macbook Pro gets one of those every month or two at least.
Sounds like a hardware problem or an incompatible extension (.kext).
My MBP has only given that message 1-2x in 24 months, and I've only seen the spinning beachball a few times. My MBP is rarely rebooted, I usually just put it to sleep.
not bug Feature
It's not like you can steal stuff from the computers. It would just be an annoyance, cause then you hit the power button, and continue. You could possibly lose stuff that you were working on but that's about it. I'm sure we'll see a hotfix in the near future.
If it was in vista too, how come it took this long to find?
The fact that it also affects Vista proves that Microsoft is serious about backwards compatibility.
Time to shut port 455. Years ago we used to shut down ports that were not necessary for operation. The idea was to prevent security problems.
confirmed to work on windows 7 64bit (crashed it three times about 20 minutes ago...)
Does this exploit work over LAN or WAN? Doesn't matter to me at all if it is LAN only. Nice article but for those of us who aren't geniuses kind of looks like something that is a non issue.
if only you could have 3rd party SMB for windows. sadly they seemed to want to monopolies this.
Time to shut port 455. Years ago we used to shut down ports that were not necessary for operation. The idea was to prevent security problems.
That's but one of many reasons I recommend a separate firewall/router for all users. That router should block all traffic on Windows/CIFS/SMB ports, there is no viable reason to have those accessible on the Internet. That doesn't eliminate the problem, but it localizes it to your LAN, thus minimizing the exposure. If your LAN is as dangerous as the Internet, you've got bigger issues.
If you need to connect into work, use a VPN and those ports/protocols can run over the VPN.
Does this exploit work over LAN or WAN? Doesn't matter to me at all if it is LAN only. Nice article but for those of us who aren't geniuses kind of looks like something that is a non issue.
I think most ISPs block traffic on this port because of all the issues it brings... like file shares over the internet (I had fun with that lol). Most routers should be blocking it as well but that doesn't mean your safe. plug directly into the internet with an ISP that doesn't block traffic on that port and your vulnerable.
It's a very real concern for any user. for example: piss of someone in an online chat or something and they could DoS your computer. a simple loop in the python script and as long as your computer is connected to the internet you wouldn't be able to use it (would normal users think to unhook the internet when they get a BSOD? not unless they take it in to be "fixed" = $$$ free cash for the tech)
Just because this implementation of the exploit causes BSODs doesn't mean it's the only thing the bug could do.. maybe there's an opening for getting arbitrary code to execute?
Bring Back C:\con\con!!!!!!
rooket:
If it works over lan it will work over wan since wan is like a huge lan working on the same principles.
However in the best/worse case scenario a lan exploit needs some tweaking in order to become effective over wan.
what he meant by that was... if you got someone hacking you using your lan... you might wanna check the guy next to you.. or someone that shouldn't be using your lan is...
Has it ever occurred to you guys that Apple could be paying these guys off to have a crack at Windows? Well, just a thought.
actuallyBSODs are to Windows as the Kernel Panic is to Mac OSX
Yes, this is not the hour glass of doom or the spinning Blue Ring of Death, which would be equivalent of the beach ball.
not bug Feature
It wouldn't surprise me if they said that. Remember the Win 7 UAC exploit?
Has it ever occurred to you guys that Apple could be paying these guys off to have a crack at Windows? Well, just a thought.
Well it makes finding bugs easier for Microsoft so in the end it's probably benefiting everyone except Apple.
big friking deal, stop hyping on nonsense.
useless article ment for weak ppl. Now all go buy most expensive anti-virus.
The fact that it also affects Vista proves that Microsoft is serious about backwards compatibility.
^+1
big friking deal, stop hyping on nonsense.useless article ment for weak ppl. Now all go buy most expensive anti-virus.
Anti-virus? What's that? No one has stolen my credit info yet, I'm good.
It's not like you can steal stuff from the computers. It would just be an annoyance, cause then you hit the power button, and continue. You could possibly lose stuff that you were working on but that's about it. I'm sure we'll see a hotfix in the near future.If it was in vista too, how come it took this long to find?
Though more and more apps are being built with the ability to recover data from a power loss. I use Open Office and Ultra Edit as my text editor of choice. After my last power loss, both asked me if I wanted to recover lost data upon reboot.
http://www.reversemode.com/index.p [...] &Itemid=15
"This is the reason why this vulnerability is a Remote Code Execution and not only a DoS."
Not everyone knows how to block these types of attacks I remeber a LONG time ago I was in the beta program for @home in Oregon Cable internet I was one of the first 200 people in Oregon to get it and the way their "Certified installer" set me up I could see the C$ share of about 80 other people I could even map their printers, I don't even think the installer was out the door before I fixed that F-UP of his but I will bet all the people setup wrong were blissfully unawear of the issue. Long before ATT purchased them and Comcast Purchased ATT all Cable Modems atlease in Oregon where set up like a WAN or a MAN with Sharing turned on.
hey, i already have windows 7 because my mother works for Fujitsu and they already stocked it for there IT staff so i now have windows 7 running on my netbook and 5 of my desktops and its greaat. It is just as goo dlooking as vista but smooth as ice, i see no abrupt slowdows or glithces like in vista and i just installed software from the 90's on my win7 comp and it worked flawlessly.Its a great software.
Busine$$ as usual at m$... Usually, the first reaction to unknown events or data, in m$ code, is to go tits up.
Just another proof that $even is a completely new o$, obviously nothing in common with vi$hta...
Saw this last night, there's a windows "proof of concept" version and there's actually a version of it going around that runs off Android cellphones.... so you can take out a vista box on your network, via your cellphone! It's in the Android market as BSODROID and on http://www.dereenigne.com/