New Remotely Exploitable Vulnerability Found in 64-bit Win7
An independent researcher has discovered a remotely exploitable vulnerability in Windows 7 that's linked to Apple's Safari browser.
Threat Post, a Kaspersky Lab security news service, reports that researchers are now warning about a new remotely exploitable vulnerability discovered in the 64-bit version of Windows 7. This vulnerability can be used by an attacker to run arbitrary code with kernel-mode privileges on a vulnerable machine.
The problem was first reported days ago by an independent researcher via Twitter, but has since been confirmed by Secunia. He claimed to have discovered a method for exploiting the vulnerability by simply feeding an iframe with an overly large height to Safari.
"A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to potentially compromise a user's system," reads the Secunia warning. "The vulnerability is caused due to an error in win32k.sys and can be exploited to corrupt memory via e.g. a specially crafted web page containing an IFRAME with an overly large "height" attribute viewed using the Apple Safari browser."
"The vulnerability is confirmed on a fully patched Windows 7 Professional 64-bit," the warning adds. "Other versions may also be affected."
After the exploit was reported, Microsoft didn't confirm the problem, but merely stated that it was investigating the evidence. "We are currently examining the issue and will take appropriate action to help ensure the customers are protected," said Jerry Bryant, group manager of response communications in Microsoft's Trustworhty Computing Group.
As indicated, the only known attack vector for this specific vulnerability is through the use of Apple's Safari browser on Windows 7. As of November 2011, the Safari browser commanded only 5.92-percent of the browser market, so there doesn't seem to be a potential widespread problem. So far there's no indication that the three most popular browsers -- Internet Explorer (40.63-percent), Chrome (25.69-percent) and Firefox (25.23-percent) -- share a similar vulnerability when used in Windows 7.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Kevin Parrish has over a decade of experience as a writer, editor, and product tester. His work focused on computer hardware, networking equipment, smartphones, tablets, gaming consoles, and other internet-connected devices. His work has appeared in Tom's Hardware, Tom's Guide, Maximum PC, Digital Trends, Android Authority, How-To Geek, Lifewire, and others.
-
amk-aka-Phantom ReplyAn independent researcher has discovered a remotely exploitable vulnerability in Windows 7 that's linked to Apple's Safari browser.
Who the hell uses Safari on Windows? :lol: Dismissed! -
molo9000 The actual vulnerability is in the NtGdiDrawStream function in the win32k.sys.Reply
Other browsers or programs that call this function might be vulnerable, too. -
JOSHSKORN nikorrOnly on Safari?ReplySo far there's no indication that the three most popular browsers -- Internet Explorer (40.63-percent), Chrome (25.69-percent) and Firefox (25.23-percent) -- share a similar vulnerability when used in Windows 7.
-
JOSHSKORN amk-aka-phantomWho the hell uses Safari on Windows? Dismissed!ReplyAs of November 2011, the Safari browser commanded only 5.92-percent of the browser market, so there doesn't seem to be a potential widespread problem.
Not that many, apparently. I installed it once just to see it, but have since then have had to reformat my computer due to a black screen, which I'm sure is unrelated, considering I never launched Safari since I'd installed and looked at it.