Microsoft is disputing Core Security Technologies’ description of a security issue impacting Microsoft’s Virtual PC software as a vulnerability.
Core Security issued an advisory March 16 for what its researchers described as a bug in the software that allowed users to circumvent various security measures in Windows. According to Core Security, there is a vulnerability in the memory management of the Virtual Machine Monitor that makes memory pages mapped above 2GB available with read or read/write access to user-space programs running in a Guest operating system.
By leveraging this vulnerability it is possible to bypass security mechanisms such as Data Execution Prevention (DEP), Safe Structured Error Handling (SafeSEH) and Address Space Layout Randomization (ASLR), according to the Core Security advisory.
In a blog post, Microsoft’s Paul Cooke, director in the Windows Client group, contested Core Security’s declaration of the situation as a vulnerability.
“The functionality that Core calls out is not an actual vulnerability per se,” Cooke wrote. “Instead, they are describing a way for an attacker to more easily exploit security vulnerabilities that must already be present on the system. It’s a subtle point, but one that folks should really understand. The protection mechanisms that are present in the Windows kernel are rendered less effective inside of a virtual machine as opposed to a physical machine. There is no vulnerability introduced, just a loss of certain security protection mechanisms.”
The bug impacts a number of versions of the product, including Microsoft Virtual PC 2007, Virtual PC 2007 SP1, Windows Virtual PC and Microsoft Virtual Server 2005. Because Microsoft’s Virtual PC hypervisor is a component of Windows 7 XP Mode, it is impacted as well.
“We believe that Windows XP Mode and Windows Virtual PC are great bridging strategies to help customers who have legacy applications get up and running on Windows 7,” Cooke blogged. “For those customers who need Windows XP Mode, they should look to install only the required subset of applications that need Windows XP in order to function properly while planning to move those applications to Windows 7 in the future.”
Microsoft’s Hyper-V technology is not affected.
