Hole in Windows Vista and 7 allows remote reboot

Page 1 of 2 12 LastLast

    Hole in Windows Vista and 7 allows remote reboot


    Posted: 08 Sep 2009
    Hole in Windows Vista and 7 allows remote reboot

    A vulnerability in Microsoft's implementation of the SMB2 protocol can be exploited via the net to crash or reboot Windows Vista and Windows 7 systems. The root of the problem is an error in how the srv2.sys driver handles client requests when the header of the "Process Id High" field contains an ampersand. The attack does not require authentication; port 445 of the target system merely has to be accessible, which in the default Windows local network configuration, it usually is. SMB2 is an extension of the conventional server message block protocol.
    More...
    LFB's Avatar Posted By: LFB
    08 Sep 2009



  1. Posts : 2,528
    Windows 7 x64 Ultimate
       #1

    Who has SMB open on their net interface?!?

    :)

    [Edit]

    I mean the artical says exploitation over the net, then says the hole is only open by default on the local network interface. :/

    You would have to go out of your way to actually make yourself vulnerable to this( from the net).
      My Computer


  2. Posts : 18,404
    Windows 7 Ultimate x64 SP1
       #2

    This says the Windows 7 RC affected, but not RTM.

    Microsoft: Windows 7 not affected by latest flaw | Beyond Binary - CNET News
      My Computer


  3. Posts : 5,807
    Windows 7 Home Premium x64 - Mac OS X 10.6.4 x64
       #3

    Airbot said:
    Good to know Airbot...some folks like to jump the gun to quickly
      My Computer


  4. Posts : 419
    Windows 7 Build 7600 64bit/Ubuntu/Leopard
       #4

    Microsoft: Windows 7 not affected by latest flaw


    Microsoft issued a formal security advisory late Tuesday on a reported zero-day flaw in Windows Vista and Windows Server 2008. However, the software maker also said that the flaw does not affect the final version of Windows 7, contrary to earlier reports.
    "Microsoft is investigating new public reports of a possible vulnerability in Microsoft Server Message Block (SMB) implementation," Microsoft said in the advisory. "We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time."
    The flaw could allow an attacker to gain control of a system, although Microsoft said that "most attempts to exploit this vulnerability will cause an affected system to stop responding and restart."
    The software maker said it is working with security software partners to provide information that can be used to create protections. Once its investigation is wrapped up, Microsoft said it will take action, which could include releasing a patch during its next monthly cycle or doing an "out-of-band" release, if necessary. Tuesday was Microsoft's monthly release for patches, which included five critical Windows updates addressing eight vulnerabilities.
    The software maker said the latest issue affects the "release candidate" version of Windows 7, but not the final version that was completed in July. Also, the recently completed Windows Server 2008 R2 is not vulnerable, Microsoft said, nor are the earlier Windows XP and Windows 2000 operating systems.
    Microsoft is already dealing with a separate, still unpatched flaw reported last week. Attacks have already been seen based on that vulnerability. Microsoft has taken issue with the fact that that flaw, like the latest one, was reported publicly as opposed to being privately disclosed to Microsoft, giving the company time to patch it.
    Source: Microsoft: Windows 7 not affected by latest flaw | Beyond Binary - CNET News
      My Computer


  5. Posts : 1,360
    Windows 7 Ultimate x64
       #5

    It's a good thing I'm not an important figure or anything, nobody would waste their time attacking my computer.
      My Computer


  6. Posts : 2,651
    W7 RTM Ultimate x64
       #6

    Same here haha :P thats just a tad scarey knowing this :S
      My Computer


  7. Posts : 1,326
    Windows 10 Professional 64-bit
       #7

    Only causes reboot? No need to worry then ^_^
      My Computer


  8. Posts : 5,807
    Windows 7 Home Premium x64 - Mac OS X 10.6.4 x64
       #8

    Lebon14 said:
    Only causes reboot? No need to worry then ^_^
    Except for the feeling of being violated
      My Computer


  9. Posts : 5,642
    Windows 10 Pro (x64)
       #9

    A properly configured firewall, at least on the router end, blocks remote SMB connections (port 445). Not sure if a consumer router+firewall is set by default to block remote SMB connections (but mine does).
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 23:23.
Find Us