[ insider_reports_insider ]
Early Vista Bug Not A Reliable Threat
David Utter
Staff Writer
2007-01-08
 Insider Reports RSS Feed
Although the debut of a threat affecting Windows component csrss.exe could impact the new Vista operating system, it does not appear to have a clear chance of doing so in every case.
 | | Early Vista Bug Not A Reliable Threat |  |
Microsoft has been digging into the particulars behind some proof of concept code posted online. This code affects the Client Server Run-Time Subsystem, or csrss.exe, and could allow for local privilege elevation on several Windows platforms, including Vista.
"Initial indications are that in order for the attack to be successful, the attacker must already have authenticated access to the target system," Microsoft noted on December 22, 2006, on its Security Response Center blog.
Security research firm Determina documented the debut of the proof of concept code. A Russian forum displayed it on December 15th; Determina notified Microsoft, who presumably have a patch in the works.
Symantec researcher Peter Ferrie followed up this disclosure by assessing the code's potential threat to Vista, Microsoft's newest operating system. Vista is set to debut in the consumer market this month, after being released to volume licensing clients in November 2006.
"The short answer is 'yes, but not reliably.' Arbitrary code execution is possible, but requires a great deal of luck, though a denial-of-service is definitely possible," Ferrie wrote in questioning the bug's impact.
Microsoft has touted Vista as its most secure operating system ever. It appears that on a completely unsecured Vista machine the bug could possibly result in privilege escalation, which could in turn lead to virtually complete control of the system.
Of course, Microsoft will gladly sell people protection against threats to its most secure operating system ever, only $49.95 per year for a subscription for up to 3 PCs to Windows OneCare.
---
Tag: Vista
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
