Zero-Day Windows 7 RTM DoS Vulnerability Has PoC Published in the Wild

Windows 7 might not have been affected by any of the November security bulletins released by Microsoft, but this doesn’t mean that the operating system is bulletproof. In fact, a zero-day vulnerability, impacting both the latest iteration of Windows client and server operating systems, has been documented in the wild. Proof of Concept code is already available for the security flaw, residing in the implementation of SMB (Server Message Block) in Windows 7 and Windows Server 2008 R2.

The Redmond company revealed that it was aware of the issues and that, at the moment, it was investigating reports related to the security flaw. Microsoft has a comprehensive system set in place for security researchers to privately disclose vulnerabilities they come across in exchange for recognition. However, researcher Laurent Gaffie did not opt to share the Windows 7 vulnerability only with the Redmond company. Instead, he disclosed details about the flaw publicly, and even made PoC available in the wild, facilitating the creation of exploits and placing all users of Windows 7 at risk.

"Microsoft is investigating new public claims of a possible denial-of-service vulnerability in Windows Server Message Block," a Microsoft spokesperson noted for eWeek. "We're currently unaware of any attacks trying to use the claimed vulnerability or of customer impact. Once we're done investigating, we will take appropriate action to help protect customers. This may include providing a security update through the monthly release process, an out-of-cycle update or additional guidance to help customers protect themselves."

Dubbed Windows 7, Server 2008R2 Remote Kernel Crash, the vulnerability, in scenarios involving successful exploit, makes it possible for attackers to perform Denial of Service on the two operating systems. Gaffie noted that the vulnerability affected only Windows 7 and Windows Server 2008 R2, and downplayed the platforms for their level of security. Both LAN and Internet Explorer 8 can be used as avenues for attack, the security researcher revealed. At this point in time, no patch exists for the Windows 7 SMB DoS vulnerability.