Microsoft is disputing
Core Security Technologies' description
of a security issue impacting Microsoft's Virtual PC software as a vulnerability.
Core Security issued an
advisory March 16 for what its researchers described as a bug in the software
that allowed users to circumvent various security measures in Windows.
According to Core Security, there is a vulnerability in the memory management
of the Virtual Machine Monitor that makes memory pages mapped above 2GB
available with read or read/write access to user-space programs running in a
Guest operating system.
By leveraging this
vulnerability it is possible to bypass security mechanisms such as Data
Execution Prevention (DEP), Safe Structured Error Handling (SafeSEH) and
Address Space Layout Randomization (ASLR), according
to the Core Security advisory.
In
a blog post, Microsoft’s Paul Cooke, director in the Windows Client group,
contested Core Security’s declaration of the situation as a vulnerability.
“The functionality that
Core calls out is not an actual vulnerability per se,” Cooke wrote. “Instead,
they are describing a way for an attacker to more easily exploit security
vulnerabilities that must already be present on the system. It's a subtle
point, but one that folks should really understand. The protection mechanisms
that are present in the Windows kernel are rendered less effective inside of a
virtual machine as opposed to a physical machine. There is no vulnerability
introduced, just a loss of certain security protection mechanisms.”
The bug impacts a number
of versions of the product, including Microsoft Virtual PC 2007, Virtual PC 2007 SP1, Windows
Virtual PC and Microsoft Virtual Server 2005. Because Microsoft's Virtual PC
hypervisor is a component of Windows 7 XP Mode, it is impacted as well.
“We believe that Windows
XP Mode and Windows Virtual PC are great bridging strategies to help customers
who have legacy applications get up and running on Windows 7,” Cooke blogged.
“For those customers who need Windows XP Mode, they should look to install only
the required subset of applications that need Windows XP in order to function
properly while planning to move those applications to Windows 7 in the future.”
Microsoft’s Hyper-V
technology is not affected.
IT Security & Network Security News & Reviews News & Reviews 
