Russian company picks hole in XP Service Pack 2

Russian security company, Positive Technologies, has released a patch to a security hole it said it discovered in Microsoft's Windows XP Service Pack 2 (SP2) last year.

"We found two small flaws that a programmer could use to go around the SP2 mechanism Data Execution Protection [DEP]," Positive Technologies chief technology officer, Yury Maximov, said.

As Microsoft explains on its website, DEP is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system. According to Maximov, Positive Technologies informed the software maker on December 22 about a problem with DEP and was told to wait for a response from the company.

"It has been over one month and we have not heard from Microsoft, so we decided to issue our own patch," Maximov said. "We understand that Microsoft wants to protect its product, but we feel it is more important for people to know about the problem and to know there is a tool to protect them."

He said that it was his understanding that hacker groups were already working on ways to exploit the holes in DEP so as to insert rogue code into a PC's memory.

Microsoft is still investigating the issue, but early analysis indicates the bypassing of DEP and the heap overflow protection feature in Windows XP SP2 is not a security vulnerability, a Microsoft spokesperson said.

"An attacker cannot use this method by itself to attempt to run malicious code on a user's system," she said.

Microsoft was also not aware of any attack exploiting the issue, the spokesperson said.

"Customers are not at risk from the situation,' she said.

Still, Microsoft is looking at ways to prevent the bypassing of the Windows XP SP2 protection features either through an update as part of its monthly security patch cycle or in a service pack, the spokesperson said.

Positive Technologies, in Moscow, haes developed a temporary security measure, which it made available as a free utility called PTmsHORP, Maximov said.

The security hole could not be fully eliminated by a separate patch, he said, and Positive Technologies assumed Microsoft was not going to publish the problem or issue a security fix before the release of Service Pack 3.

But some analysts question the wisdom of downloading third-party patches.

"Personally, I would not advise people installing such patches," Ovum analyst, Graham Titterington, said. "There is a lot of danger in installing patches from people or companies you're not absolutely sure of. Chances are there wouldn't be a problem, but that is a risk not worth taking."

When other companies made publicly known the security problems within Microsoft products such as SP2, it put pressure on Microsoft to address the issue, Titterington said, but publishing third-party patches could possibly further the problem.

"I agree that not having heard from Microsoft for a month was slightly undesirable, but the response time for situations like this are usually more like three months," Titterington said.

The PTmsHORP utility can be can be found online for download at www.ptsecurity.ru/ptmshorp.asp or at www.maxpatrol.com/ptmshorp.asp.

Joris Evers in San Francisco contributed to this report.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Laura Rohde

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?