17-year-old Windows Flaw Affects All Since NT

[topgear]

Windows Virtual DOS Machine bug from 17 years ago affects Windows 7 users today.

We often hear of Windows security bugs that plague a recent version of the operating system that many are still using today, but rarely do we hear of a bug that reaches all the way back – 17 years – to Windows NT.


Tavis Ormandy, a security researcher at Google, discovered a security flaw in the Virtual DOS Machine that can allow a nefarious user to inject code into the kernal and possibly install malware.


Given that all modern versions of Windows still feature the Virtual DOS Machine, this is a vulnerability that still exists today.


Ormandy wrote:


"All 32bit x86 versions of Windows NT released since 27-Jul-1993 are believed to be affected, including but not limited to the following actively supported versions:


- Windows 2000


- Windows XP


- Windows Server 2003


- Windows Vista


- Windows Server 2008


- Windows 7"


Microsoft has yet to respond to the flaw, and until it does with a patch, Ormandy recommends the following as a way to mitigate the hole:


"Temporarily disabling the MSDOS and WOWEXEC subsystems will prevent the attack from functioning, as without a process with VdmAllowed, it is not possible to access NtVdmControl() (without SeTcbPrivilege, of course).


"The policy template "Windows Components\Application Compatibility\Prevent access to 16-bit applications" may be used within the group policy editor to prevent unprivileged users from executing 16-bit applications. I'm informed this is an officially supported machine configuration."

http://www.tomshardware.com/news/win...flaw,9477.html

Criticize windows for one more time ( hardcore tux fans )

[tarey_g]

^^ seems like a opportunity, MS has given very few reasons to the haters to bash since long time. Good times for MS.

[rajkumar_personal]

Talk about ERROR PROPAGATION !!!
But it happens man.....
We are all after all....HUMAN !!