Vista Exploit Surfaces on Russian Hacker Site

[s18000rpm]

Proof-of-concept exploit code for a privilege escalation vulnerability affecting all versions of Windows—including Vista—has been posted on a Russian hacker forum, forcing Microsoft to activate its emergency response process.

Mike Reavey, operations manager of the Microsoft Security Response Center, confirmed that the company is "closely monitoring" the public posting, which first appeared on a Russian language forum on Dec. 15. It affects "csrss.exe," which is the main executable for the Microsoft Client/Server Runtime Server.

According to an alert cross-posted to security mailing lists, the vulnerability is caused by a memory corruption when certain strings are sent through the MessageBox API.

"The PoC reportedly allows for local elevation of privilege on Windows 2000 SP4, Windows Server 2003 SP1, Windows XP SP1, Windows XP SP2 and Windows Vista operating systems," Reavey said in an entry posted late Dec. 21 on the MSRC blog.

"Initial indications are that in order for the attack to be successful, the attacker must already have authenticated access to the target system. Of course these are preliminary findings and we have activated our emergency response process involving a multitude of folks who are investigating the issue in depth to determine the full scope and potential impact to Microsoft's customers," Reavey added.


"While I know this is a vulnerability that impacts Windows Vista I still have every confidence that Windows Vista is our most secure platform to date," he added.

The MSRC is expected to issue a formal security advisory with pre-patch workarounds. In the interim, the company is urging customers to enable a firewall, apply all security updates and install anti-virus and anti-spyware protection.

To date, there are no reports of actual attacks against Windows users.

The Microsoft confirmation comes hard on the heels of a claim by anti-virus vendor Trend Micro that underground hackers are selling zero-day exploits for Windows Vista at $50,000 a pop.

source: neowin news

[techtronic]

I will buy and Install Vista only when Vista Service Pack 1 is launched

[Vyasram]

^^ i will never buy it

[knight17]

^^
75% of us will not "buy" it.

[Choto Cheeta]

Originally Posted by knight17

^^
75% of us will not "buy" it.

thats quote true... Piracy and pirates will find a way out.. they have allways...

anyway regarding trusting vista... umm.. those people who run windows XP knowning how to keep the system safe, they can also run Vista, as the if one has basic idea to keep the system safe in XP, will never going face any problem wth Vista either...