Windows 7: Security bug bites 64-bit Windows 7

Microsoft on Tuesday warned users of a vulnerability in 64-bit versions of Windows 7 and Windows Server 2008 R2 that could expose users to malware attacks.

Exploitation of the bug in the Canonical Display Driver would most likely cause vulnerable machines only to reboot, Microsoft spokesman Jerry Bryant said in a blog post. But it could also be abused to silently install malware, although attackers first would have to bypass memory randomization protections baked in to the operating systems to prevent code execution attacks, he added.

The vulnerability stems from the Canonical Display Driver's failure to properly parse information copied from user mode to kernel mode. Malicious hackers could exploit it by tricking a victim into viewing a booby-trapped image file on a website or in email. The driver emulates the Windows XP display driver for interactions with earlier Windows graphics engines.

Bryant said a patch would be forthcoming, but didn't say when. In the meantime, users can prevent attacks by disabling the Windows Aero Theme. To turn it off, choose Start > Control Panel and click on Appearance and Personalization. Then click on Change the Theme. Then select one of the Basic and High Contrast Themes.

Since becoming aware of the forum discussions, we have been looking for ways to hit this vulnerability with Microsoft software. So far, we haven’t found a remote vector. We’re still looking and meanwhile managed to hit the vulnerable code by executing a specially-crafted program on a machine in the following configuration:

• Windows 7 X64 machine
• WDDM 1.1 capable video card (DirectX 10, DirectX 10.1, DirectX 11)
• Aero glass theme enabled

Therefore, a malicious attacker able to logon locally to a vulnerable machine matching the above criteria could run a malicious executable to trigger this issue. Users of third-party image viewers may be vulnerable to this issue when viewing an untrusted image with a third-party image viewer locally on the machine.
{bold added}