Daily cyber threats and internet security news: network security, online safety and latest security alerts
November 22nd, 2008

Attackers Might Run Unauthorized Code On Any Vista PC Due To A Flaw

An Austrian security vendor has found a vulnerability in Windows Vista that it says could possibly allow an attacker to run unauthorized code on a PC. The vulnerability could allow a hacker to install a rootkit that is very difficult to detect and remove from a computer or any other malicious software.

The problem is rooted in the Device IO Control, which handles internal device communication. Researchers at Phion have found two different ways to cause a buffer overflow that could corrupt the memory of the operating system’s kernel.

In one of the scenarios, a person would already have to have administrative rights to the PC. In general, vulnerabilities that require that level of access somewhat undermine the risk since the attacker already has permission to use to the PC. But it may be possible to trigger the buffer overflow without administrative rights, said Thomas Unterleitner, Phion’s director of endpoint security software.

Phion notified Microsoft about the problem on 22 October. Microsoft indicated to Phion that it would issue a patch with Vista’s next service pack. Microsoft released a beta version of Vista’s second service pack to testers last month. Vista’s Service Pack 2 is due for release by June 2009.

Unterleitner said there has been lots of interest in the vulnerability. “We have received requests for detailed information on how to take advantage of this exploit from all over the world,” he said.

Currently there are no comments from Microsoft officials on this issue.

Share this item with others:

More on CyberInsecure:
  • High-risk Vulnerabilities In Google Chrome
  • Microsoft Releases Emergency Patch For Critical Windows Vulnerability
  • High Risk Of Malicious Code Execution Attacks Due To Mac OS X 6-month Old Java Flaw
  • QuickTime Crashing Zero-day Attack Code Published, Malicious Code Execution Possible
  • ProFTPD Distribution Server Compromised For 3 Days, Sources Backdoored With Root Shell

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Attackers Might Run Unauthorized Code On Any Vista PC Due To A Flaw

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.