Win 7 remote kernel crasher code released
Microsoft has reportedly begun investigating a potentially nasty denial of service vulnerability affecting Windows 7.
A security bug in windows 7 and Windows 2008R2 makes it possible to lock up affected systems. The crash would happen without a Blue Screen of Death or other visible indication that anything was amiss.
The system freeze can be triggered remotely by sending malformed packets to targeted systems – specifically a NetBIOS (Network Basic Input/Output System) header that specifies an incoming SMB packet is either four bytes smaller or larger than it actually is. Server Message Block (SMB) is a network protocol used to provide shared access to files and printers.
Proof of concept code was posted by white hat security researcher Laurent Gaffié in a blog entry on Wednesday. “Whatever your firewall is set to, you can get remotely smashed via IE or even via some broadcasting nbns tricks, [with] no user interaction,” Gaffié writes.