|
25 January 2010 ,
Written by Dhruv Tanwar
|
|
“Better late than never,” seems to be the case with Microsoft's latest advisory for a bug in its Windows system. In a fresh advisory, the company warning users of all 32-bit versions of Windows about a bug dating back 17 years that could potentially be used by hackers to hijack their computers.
Microsoft said it was not aware of any attacks “that try to use the reported vulnerability or of customer impact at this time.” It said it is now working with partners to “provide information that they can use to provide broader protections to customers.”
“An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” the advisory said. For now, Microsoft has not said when it would most likely fix the flaw, even though its next scheduled security update is slated for February 9.
The vulnerability in the Windows Virtual DOS Machine (VDM) subsystem was disclosed last week by Google engineer Tavis Ormandy, on the Full Disclosure security mailing list. The subsystem was added to Windows in the July 1993 release of Windows NT, which was also Microsoft's first fully 32-bit operating system. It enables Windows NT and later versions of Windows to run DOS and 16-bit Windows software. Even Microsoft's latest release, Windows 7, has the bug. In its advisory, Microsoft advised users on how to disable VDM as a workaround, by adjusting settings to preventing access to 16-bit applications. |