Windows hole discovered after 17 years
h-online.com
h-online.com
It's a cool bug, but it's a bit strange to see it get written up like this, because it doesn't matter a whole lot. On most Windows machines, if you have a normal user account, you have everything you need; in corporate environments, if you have one admin password you probably have all of them; in servers, the user account you bust is probably a local admin.
http://archives.neohapsis.com/archives/fulldisclosure/2010-0...
This is an awesome bug; he had to use CreateRemoteThread to jump into a process with special permissions, then exploit the difference in the way segment selectors are handled from normal 32 bit code and simulated real mode, and finally write code that would make the iret instruction fail to get a trap frame to play with.
With the resources both Google and Microsoft have at their disposal, I wonder if it's worth having a few employees discovering security flaws in your opponent's platform.
Google would lose because they make big claims about security and their opponents know about lots of security flaws??
Why? Because Google and Microsoft have a lot more to fear from 4 person companies spending 90% of their time researching vulnerabilities than they do from each other, and waving flaws around as if they were some kind of point score concedes a huge marketing point.
Google would lose because Microsoft outspends Google significantly on vulnerability research. This particular arms race is never going to happen, but if it did, Microsoft would win it.
There is a difference. It's much easier to upgrade Google's applications than Microsoft's. When Google patches Gmail, it takes a couple minutes for me to enjoy my corrected version. When Microsoft issues a correction, it could take weeks until it hits the Windows Update servers and that could easily turn into months before many businesses incorporate it into their update sets.
It's not only the size of the attack surface, but the time it remains open. There is also a huge factor in public perception - people perceive their computers as imperfect mostly because they are astonishingly unreliable. If Google can make people happier with their computers and web applications than they are with Windows and desktop apps, Microsoft will have a huge problem that may not be solvable by throwing money and people at it.
Remember Google has deep pockets and less legacy to protect. They can move fast.
Microsoft has a very complicated entanglement of obligations and expectations they will have a hard time compromising. The perception of a rule-changing development is incredibly dangerous for them, and giving mixed messages about which way their corporate clients should go with their IT infrastructure won't help either.
Why do you think Microsoft would end up in advantage after such a confrontation?
Advances in technology are bound to expose flaws in older products, so what's the news here?
So this affects current products. And affects virtually every Windows machine in use on virtually any corporate network.
The only good thing about it from the description is that it is a local privilege escalation only.
Edit: and it appears there's an effective way to mitigate this, disable the 16-bit support in group policy.
Operating systems are rife with security flaws. Uniformly.
I think IBM can provide a mainframe fresh off the assembly line that can run 70's software.
Most amazingly, many do.
I see no reason for a modern x86 (Oh God... What am I saying) to be able to faithfully run code targeted for the 8088. Heck... I am not sure if there is any reason to even support 487 instructions...