A security researcher discovers a bug that could be used to trigger a crash in Windows 7 and Windows Server 2008 Release 2.
Less than 24 hours after
Microsoft's
Patch Tuesday, a security researcher revealed a zero-day bug affecting
Windows 7 and Windows Server 2008 Release 2.
Researcher Laurent Gaffie posted proof-of-concept code as well as
information about the flaw on his blog and the
Full Disclosure mailing
list Nov. 11. The exploit takes advantage of the implementation of SMB
(Server Message Block). An attacker can use the bug to remotely crash Windows 7
and Windows Server 2008 R2 on a LAN or
via Internet Explorer. Technical details
can
be found here.
A
Microsoft spokesperson said the company is looking into the matter.
"Microsoft is investigating new public claims of a possible denial-of-service
vulnerability in Windows Server Message Block," the spokesperson said
in an e-mail. "We're currently unaware of any attacks trying to use the
claimed vulnerability or of customer impact. Once we're done
investigating, we will take appropriate action to help protect customers. This
may include providing a security update through the monthly release process, an
out-of-cycle update or additional guidance to help customers protect
themselves."
While users await a patch, Gaffie advised users close the SMB feature and
ports.
November's Patch Tuesday update addressed 15 security vulnerabilities affecting
Windows and Microsoft Office.
Email
Print
