CyberInsecure.com

Attackers Might Run Unauthorized Code On Any Vista PC Due To A Flaw

An Austrian security vendor has found a vulnerability in Windows Vista that it says could possibly allow an attacker to run unauthorized code on a PC. The vulnerability could allow a hacker to install a rootkit that is very difficult to detect and remove from a computer or any other malicious software.

The problem is rooted in the Device IO Control, which handles internal device communication. Researchers at Phion have found two different ways to cause a buffer overflow that could corrupt the memory of the operating system’s kernel.

In one of the scenarios, a person would already have to have administrative rights to the PC. In general, vulnerabilities that require that level of access somewhat undermine the risk since the attacker already has permission to use to the PC. But it may be possible to trigger the buffer overflow without administrative rights, said Thomas Unterleitner, Phion’s director of endpoint security software.

Phion notified Microsoft about the problem on 22 October. Microsoft indicated to Phion that it would issue a patch with Vista’s next service pack. Microsoft released a beta version of Vista’s second service pack to testers last month. Vista’s Service Pack 2 is due for release by June 2009.

Unterleitner said there has been lots of interest in the vulnerability. “We have received requests for detailed information on how to take advantage of this exploit from all over the world,” he said.

Currently there are no comments from Microsoft officials on this issue.

Share this item with others:

Posted in Malware, Microsoft, Software, Vista, Vulnerabilities |  Print This Post