Vista kernel vulnerability found
CNET reported that a flaw in the Vista operating systems networking can crash the system, allow rootkits to be hidden, or allow denial-of-service attacks to be launched, but no fix is expected until the next service pack. 
The vulnerability, announced Friday, was found by Thomas Unterleitner of the Austrian security company Phion. Unterleitner had told Microsoft about the flaw in October, but understood that a fix would only be issued in the next Vista service pack, according to CNET. Unterleitner had informed ZDNet UK of the flaw on Friday. Unterleitner’s disclosure of the flaw, a TCP/IP stack buffer overflow, reveals that the issue lies in the network input/output subsystem of Vista. Certain requests sent to the iphipapi.dll API can cause a buffer overflow that can corrupt the Vista kernel memory and cause a blue screen of death crash.
Unterleitner and colleagues determined that Vista Enterprise and Vista Ultimate were definitely affected by the flaw, with other versions of the operating system “very likely” affected. Both 32-bit and 64-bit systems are affected. Windows XP is not affected. Some 35% of Enterprise users of Vista “downgrade” their systems to XP, according to InfoWorld.
Unterleitner pointed out that administrative rights were needed to execute a program calling the function that would cause the buffer overflow, but said that it was possible, not yet confirmed, that someone could use a malformed DHCP packet to “take advantage of the exploit without administrative rights.”
-Bill at Cheshire Cat Photo™
You can view higher-resolution photos (*generally* 7-30 megabytes, compressed) at the Cheshire Cat Photo™ Pro Gallery on Shutterfly™, where you can also order prints and gifts decorated with the photos of your choice from the gallery. Apparel and other gifts decorated with some of our most popular photos can be ordered from the Cheshire Cat Photo™ Store on CafePress®. Both Shutterfly™ and CafePress® ship to most international locations worldwide! If you don’t see what you want or would like to receive an email when new photos are up on the site, send us an email at info@cheshirecatphoto.com.
