New MS Vulnerability Notice

Published on January 9, 2011 By DrJBHL In Personal Computing

Hi folks, I hope you’re enjoying the weekend.

I just became aware of this and thought you should also although there’s no fix for it at present. XP and Vista appear to be vulnerable while Windows 7 does not.

Microsoft Security Advisory (2490606)

Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution

Published: January 04, 2011 | Updated: January 05, 2011

Version: 1.1

General Information

Executive Summary

Microsoft is investigating new public reports of a vulnerability in the Windows Graphics Rendering Engine. An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the logged-on user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time.

We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

CVE Reference

CVE-2010-3970

Microsoft Knowledge Base Article

2490606

Affected and Non-Affected Software

This advisory discusses the following software.

Affected Software

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack *

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack *

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Non-Affected Software

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

**Server Core installation not affected. The vulnerabilities discussed in this advisory do not affect supported editions of Windows Server 2008 as indicated, when installed using the Server Core installation option. For more information on this installation option, see the TechNet articles, Managing a Server Core Installation and Servicing a Server Core Installation. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Comments

Uvah

on Jan 09, 2011

This is some serious stuff Doc. I'm not a conspiracy nut but this is plenty fuel for the fire. Some may think it intentional that it only targets XP and Vista. Microsoft is due to stop support for XP soon and Vista is not exactly user-friendly. Maybe a good idea to debunk that. IMHO

DrJBHL

on Jan 09, 2011

I believe that MS plugged that hole for W7 during it's development.

I don't think there's a conspiracy beyond the hackers' intention to harm, that is.

Uvah

on Jan 09, 2011

Hope not. Microsoft gets enough negative feedback.

Philly0381

on Jan 09, 2011

It's been said before, but being the most used if not the most popular OS has it consequences.

Uvah

on Jan 09, 2011

Unfortunate but true.

Dr Guy

on Jan 10, 2011

Just remember these when you see those commercial about "cloud" computing. What enables those clouds is also what enables the bad guys to do these things.

DrJBHL

on Jan 10, 2011

Actually, the vulnerabilities are in the OS. Cloud computing (like every process on your computer) depends on you being able to get to the Cloud. You need an OS to do that.

Cloud computing will actually ease the security problems, I believe. It depends on which phase of it's development we discuss.

Uvah

on Jan 10, 2011

Lets begin with the cloud. I know you can project images on them.

Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:

Richer content, access to many features that are disabled for guests like commenting on the forums.
Access to a great community, with a massive database of many, many areas of interest.
Access to contests & subscription offers like exclusive emails.
It's simple, and FREE!