Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Researchers have detailed a current vulnerability in Windows 7 that allows school kids, university students and other local users to side-step security controls and gain administrator access. The low-severity NULL pointer dereference bug focused on the "rather complex and still largely unexplored" NTFS file system which was exploited via a crafted USB volume. Gynvael Coldwind found the vulnerability while Mateusz "j00ru" Jurczyk wrote the exploit.
Together, they said it served as an interesting case study of Windows kernel exploitation using novel techniques to achieve reliable code execution with escalated privileges. "Windows actively uses so many interesting system structures (in)directly controlled from user-mode that there is always one that fits properly, even for very complicated types of memory corruption conditions," the researchers wrote. "...The only scenario in which it might be a problem security-wise is a local computer shared between multiple users with restricted privileges and thus has been rated as low-severity by both us and MSRC (Microsoft Security Response Center)."
They said the exploit might work on earlier Windows operating systems but did not reproduce on Windows 8. Microsoft was reportedly investigating a potential fix for stability purposes. Technical details on the bug and exploit were available on both Coldwind's and Jurczyk's blogs.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.