Company is investigating a possible denial-of-service vulnerability in Windows Server Message Block
Security researcher Laurent Graffie mocked Microsoft (NSDQ: MSFT)'s Secure Development Lifecycle process in a blog post on Wednesday in which he published proof-of-concept exploit code that he claims can crash Windows 7 and Windows Server 2008 R2.
"This bug is a real proof that SDL #FAIL," he wrote, adding "The bug is so noob it should have been spotted 2 years ago by the SDL if the SDL [had] ever existed."
The vulnerability appears to reside in Microsoft's Windows Sever Message Block (SMB) software.
Microsoft patched a previous SMB vulnerability in late September, one that Graffie disclosed -- irresponsibly, Microsoft claimed -- earlier that month.
Responsible disclosure generally involves notifying software vendors about vulnerabilities so they can create a patch before the information becomes public.
In the case of Graffie's latest find, he says that he notified Microsoft on November 8 and released his proof-of-concept code on November 11.
In an e-mailed statement, Christopher Budd, security response communications lead at Microsoft, said that the company is investigating a possible denial-of-service vulnerability in Windows Server Message Block.
"We're currently unaware of any attacks trying to use the claimed vulnerability or of customer impact," he said. "Once we're done investigating, we will take appropriate action to help protect customers. This may include providing a security update through the monthly release process, an out-of-cycle update or additional guidance to help customers protect themselves."
Simon Price, writing for the Praetorian Perfect blog, claims to have tested the exploit successfully.
"The operating system actually freezes," he said. "There is no error message, no blue screen of death, no indication that anything has gone wrong. Even after power cycling, the event logs show no sign of a mishap, aside from the typical events generated from booting up again."
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024