nsane.forums Posted July 2, 2010 Share Posted July 2, 2010 Vupen Security researchers warn of threat Vulnerability research firm Vupen Security has released details of a new zero day flaw affecting Windows Vista and Windows Server 2008 that could allow hackers to crash an affected system. Vupen detailed the Microsoft Windows Kernel Local use-after-free vulnerability in an update on its site, rating it as a moderate risk largely because it is not remotely exploitable. The flaw affects Windows Vista Service Pack 2 and Server 2008 Service Pack 2 users, according to the note. "A vulnerability has been identified in Microsoft Windows, which could be exploited by local attackers to cause a denial of service or potentially gain elevated privileges,†read the statement. "This issue is caused by a use-after-free error when a call to the kernel function "LockProcessByClientId()" via the "NtUserCheckAccessForIntegrityLevel()" fails, which could allow malicious users to crash an affected system or potentially execute arbitrary code with kernel privileges." Microsoft had yet to respond at the time of writing. The news comes as Redmond admitted over 10,000 PCs have now been hit by attacks exploiting a publicised flaw in the Windows Help and Support Center. The attack was first disclosed by Google security engineer Tavis Ormandy, but security experts were quick to denounce his actions in disclosing before Microsoft had time to develop a fix. View: Original Article Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.