17-year-old Windows Flaw Affects All Since NT

[Darth Sushi]

http://media.bestofmicro.com/windows-security,8-5-164885-1.png17-year-old Windows Flaw Affects All Since NT
January 20, 2010 by Marcus Yam

" Windows Virtual DOS Machine bug from 17 years ago affects Windows 7 users today.

We often hear of Windows security bugs that plague a recent version of the operating system that many are still using today, but rarely do we hear of a bug that reaches all the way back – 17 years – to Windows NT.

Tavis Ormandy, a security researcher at Google, discovered a security flaw in the Virtual DOS Machine that can allow a nefarious user to inject code into the kernal and possibly install malware.

Given that all modern versions of Windows still feature the Virtual DOS Machine, this is a vulnerability that still exists today.

Ormandy wrote:

"All 32bit x86 versions of Windows NT released since 27-Jul-1993 are believed to be affected, including but not limited to the following actively supported versions:

- Windows 2000

- Windows XP

- Windows Server 2003

- Windows Vista

- Windows Server 2008

- Windows 7"

Microsoft has yet to respond to the flaw, and until it does with a patch, Ormandy recommends the following as a way to mitigate the hole:

"Temporarily disabling the MSDOS and WOWEXEC subsystems will prevent the attack from functioning, as without a process with VdmAllowed, it is not possible to access NtVdmControl() (without SeTcbPrivilege, of course).

"The policy template "Windows Components\Application Compatibility\Prevent access to 16-bit applications" may be used within the group policy editor to prevent unprivileged users from executing 16-bit applications. I'm informed this is an officially supported machine configuration." "

:source: Source: http://www.tomshardware.com/news/windows-7-dos-security-flaw,9477.html

[Rart]

I'm a little bit on the fence as to whether this information should be publicized in the first place. On the one hand it's great to warn users about potential flaws like this so they can prevent them from occurring, but on the flip side it's just providing more exposure to this exploit on a site that only a small minority that is tech savvy of the population will actually read it, perhaps giving some hackers a few ideas while not really providing the "prevention" options to much of the general populace.