Microsoft Reacts to Windows 7 0-Day DoS Vulnerability

[Peaches]

Microsoft Reacts to Windows 7 0-Day DoS Vulnerability

Publishes Security Advisory 977544

by Marius Oiaga

Nov. 14, 2009

Microsoft has reacted rapidly to public reports of a zero-day denial-of-service vulnerability in its latest iterations of the Windows client and server operating systems, and is providing customers with guidance on how to block potential attempts to take advantage of the security flaw. In this regard, the Redmond company has underlined that no exploits or attacks have been detected for the denial-of-service (DoS) hole in the Microsoft Server Message Block (SMB) Protocol impacting both SMBv1 and SMBv2 in Windows 7 and Windows Server 2008 R2. However, Proof of Concept (PoC) code was irresponsibly published in the wild, making it extremely easy for attackers to build exploits putting at risk users of Windows 7.

"Microsoft is aware of public, detailed exploit code that would cause a system to stop functioning or become unreliable. If exploited, this DoS vulnerability would not allow an attacker to take control of, or install malware on, the customer's system but could cause the affected system to stop responding until manually restarted. It is important to note that the default firewall settings on Windows 7 will help block attempts to exploit this issue," Dave Forstrom, group manager, public relations, Microsoft Trustworthy Computing, revealed. "The company is not aware of attacks to exploit the reported vulnerability at this time."

More details at softpedia - http://news.softpedi...ty-127039.shtml