Microsoft warns of bug in 64-bit Windows 7

Downplays threat with low exploit rating, recommends disabling Aero

Microsoft today warned users of a vulnerability in the 64-bit versions of Windows 7 and Windows Server 2008 R2 that could be used to hijack systems.

The bug is in Windows' Canonical Display Driver, which blends the operating system's primary graphics interface, dubbed Graphics Device Interface (GDI), and DirectX to compose the desktop.

According to Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), the vulnerability affects any machine with the flashy "Aero" interface, which is the default on all but the least-expensive editions of Windows 7. Aero is an optional install on Windows Server 2008 R2.

"If exploited, it would likely cause the affected system to stop responding and restart," said Bryant in an entry on the MSRC blog . "Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)."

However, ASLR, one of the bulwarks of Windows 7's and Vista's security defenses, has been repeatedly bypassed by researchers , including two who won $10,000 cash prizes at the noted Pwn2Own hacking contest in March.

Microsoft gave the bug an exploitability index rating of "3," the lowest of the company's three-step scoring system it uses to predict the likelihood of reliable attack code appearing in the next 30 days. According to that score, Microsoft believes it's unlikely hackers will come up with an exploit in the coming month.

"We're currently developing a security update for Windows that will address the vulnerability," promised Bryant, who did not set a timetable for a patch. In lieu of a fix, users can disable Aero to protect their machines.

Attackers could exploit the vulnerability by tricking users into visiting a malicious site that hosts a rigged image file, Microsoft's advisory warned .

But an attack may require more than that seemingly simple tactic, said Andrew Storms, director of security operations at nCircle Security. "I believe what Microsoft is saying [in the advisory] is that the image viewers from Microsoft won't trigger the vulnerability, but third-party applications may."

To disable Aero, users can click Start, select Control Panel, then click on "Appearance and Personalization," Microsoft said in the advisory. Under "Presentation," users would then click "Change the Theme" and then select one of the "Basic and High Contrast Themes."

Today's advisory is not the only vulnerability not yet patched by Microsoft. A flaw in SharePoint Server 2007 was acknowledged by the company late last month, but remains unfixed.

Microsoft's next security updates are slated for release June 8.

The company won't patch this latest vulnerability that fast, said Storms. "No way," he said via instant message when asked what chance Microsoft has to ready a fix in three weeks. "They are already saying it's difficult to reproduce, [so] it will be a low priority at the moment. But the info is public, so you can bet it's getting eyeballs and things can change rapidly."

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld . Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com .

Read more about security in Computerworld's Security Knowledge Center.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags MicrosoftWindows 7

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?