Risk
11/30/2009
02:23 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

'Black Screen of Death' Linked To Microsoft Patch

A recent Microsoft security fix has been fingered as one of several possible causes of black screen Windows crashes.

Microsoft's November security patch may be to blame for the "black screen of death" that has been plaguing PC users.

Prevx, a security vendor, on Friday attributed some of the black screen crashes to a recent Window operating system change that locked down Windows registry keys.

"This change has the effect of invalidating several key registry entries if they are updated without consideration of the new ACL rules being applied," said Prevx's Dave Kennerley in a blog post. "For reference, the rule change does not appear to have been publicized adequately, if at all, with the recent Windows updates."

ACL, or Access Control List, rules set the permissions for logged-in users.

Prevx says millions of PC users could be affected by black screen crashes. A Google search for "black screen Windows," restricted to the past 24 hours, yields 436,000 results.

Forum posts seeking help about the issue are easy to find. However, it also appears that scammers are trying to take advantage of interest in the problem by promoting Web pages about the topic that launch fake antivirus scans.

According to Kennerley, the black screen issue appears to have many causes, only one of which is allegedly the ACL changes.

Prevx has identified at least 10 different scenarios that will trigger the black screen condition.

The company offers free software to fix some, but not all of these issues.

Kennerley said that black screen issues that began in the past two weeks -- since the Microsoft patch was issued -- are the most likely to be fixed with Prevx's software.

In an e-mailed statement, a Microsoft spokesperson said, "Microsoft is investigating reports that its latest release of security updates is resulting in system issues for some customers. Once we complete our investigation, we will provide detailed guidance on how to prevent or address these issues."

Update: Story updated with comment from Microsoft.

Register now for Black Hat DC, the largest and the most important security conference series in the world. It happens Jan. 31-Feb. 3, 2010, in Arlington, Va. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.