Vista stricken by embarrassing gadget hole

Today's weather? Flawed

Security vendor Finjan has claimed the credit for spotting an embarrassing flaw in Windows Vista, which Microsoft only patched this week in its monthly updates.

The exploit involves one of the most apparently innocent elements of Vista, namely the sidebar 'gadgets' whereby users load one from a selection of small utilities on to the desktop. It turns out that three of these -- the contact, weather and RSS feed gadgets -- can be exploited to launch what is euphemistically called a 'remote execution attack', a technical term describing the ability of an attacker to gain control of an affected PC.

Finjan's part of the discovery relates to the contact gadget, and the company has offered a video demonstration detailing how the exploit might work in practice. As the abridged video makes clear, the attack would require only that a user had the affected gadget loaded on the sidebar, and carried out the actions described of innocently accepting a spoof contact from a compromised website.

In its Patch Tuesday cycle, Microsoft listed the flaws as 'important' in its security bulletin, one below the most severe rating, 'critical'. The vulnerability was the only one in either category to affect only Vista, with such issues still being a rarity seven months after the operating system's consumer launch.

Rare, perhaps, but not unheard of. Only last week, news emerged of a problem in a third-party Vista driver module that could allow unsigned and potentially malevolent drivers to gain access to the Vista kernel, its most protected ring.

"This discovery is the latest example of the close cooperation between our Malicious Code Research Center and Microsoft with the goal of securing users from potential malicious attacks," crowed Finjan CTO Yuval Ben-Itzhak. It has not been disclosed who found the flaws in the other two gadgets.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John E. Dunn

Techworld.com
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?