Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

A simple HTML tag will crash 64-bit Windows 7
The Register ^ | John Leyden

Posted on 12/21/2011 10:18:07 AM PST by ShadowAce

An unpatched critical flaw in 64-bit Windows 7 leaves computers vulnerable to a full 'blue screen of death' system crash.

The memory corruption bug in x64 Win 7 could also allow malicious kernel-level code to be injected into machines, security alert biz Secunia warns. Fortunately the 32-bit version of Windows 7 is immune to the flaw, which has been pinned down to the win32k.sys operating system file - which contains the kernel portion of the Windows user interface and related infrastructure.

Proof-of-concept code showing how to crash vulnerable Win 7 boxes has been leaked: the simple HTML script, when opened in Apple's Safari web browser, quickly leads to the kernel triggering a page fault in an unmapped area of memory, which halts the machine at a blue screen of death.

The offending script is just an IFRAME tag with an overly large height attribute. Although Safari is required to spark the system crash via HTML, modern operating systems should not allow usermode applications to bring down the machine. Microsoft is now investigating the vulnerability, which was first reported by Twitter user w3bd3vil, although the software giant is racing against hackers tracing the code execution path to discover the underlying vulnerability in Windows 7.

A video of the Safari-triggered crash along with the HTML PoC can be seen here. Other exploit scenarios might also be possible. ®


TOPICS: Computers/Internet
KEYWORDS: collapse; computersecurity; default; depression; economy; hackers; html; vulnerability; windows
Navigation: use the links below to view more comments.
first 1-2021-4041-56 next last

1 posted on 12/21/2011 10:18:12 AM PST by ShadowAce
[ Post Reply | Private Reply | View Replies]

To: rdb3; Calvinist_Dark_Lord; GodGunsandGuts; CyberCowboy777; Salo; Bobsat; JosephW; ...

2 posted on 12/21/2011 10:18:57 AM PST by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 1 | View Replies]

To: ShadowAce
when opened in Apple's Safari web browser

Then the title should read "Apple's Safari has critical security flaw," but of course the Apple iPologist press would never admit that.

3 posted on 12/21/2011 10:22:29 AM PST by Thane_Banquo
[ Post Reply | Private Reply | To 1 | View Replies]

To: Thane_Banquo
Then the title should read...

While I am no fan of Apple, the title is correct.

An application should not be able to crash the system.

4 posted on 12/21/2011 10:23:39 AM PST by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 3 | View Replies]

To: Thane_Banquo
> Then the title should read "Apple's Safari has critical security flaw," but of course the Apple iPologist press would never admit that.

Oh, bull. A userland application like Safari (or any other application) should be able to make a mistaken, stupid, or malicious system call (e.g. "Crash System NOW") and the operating system should refuse to do so. It's the OS's responsibility to refuse to do bad things.

What if the "application" were a malicious piece of software? You're really claiming that the "security flaw" is in the hacker's code?

Geez, fella. Learn something about computer security before you make stupid accusations.

5 posted on 12/21/2011 10:27:15 AM PST by dayglored (Listen, strange women lying in ponds distributing swords is no basis for a system of government!)
[ Post Reply | Private Reply | To 3 | View Replies]

To: ShadowAce

So....I have the 64-bit version in my Toshiba Satellite laptop. Is there some kind of patch or other fix available from Microsoft?


6 posted on 12/21/2011 10:28:15 AM PST by gimme1ibertee ("Criticism......brings attention to an unhealthy state of things"-Winston Churchill)
[ Post Reply | Private Reply | To 4 | View Replies]

To: ShadowAce

Microsoft always has a problem with a long jump to a far pointer

I have seen them screw that up every time


7 posted on 12/21/2011 10:29:36 AM PST by Mr. K (Physically unable to profreed <--- oops, see?)
[ Post Reply | Private Reply | To 1 | View Replies]

To: gimme1ibertee

Any browser but Safari is your patch. And really who’s using the Apple browser on Windows.


8 posted on 12/21/2011 10:30:07 AM PST by discostu (How Will I Laugh Tomorrow When I Can't Even Smile Today)
[ Post Reply | Private Reply | To 6 | View Replies]

To: Thane_Banquo

Ok, so what happens when the same html is run on OS X? Windows flaw.


9 posted on 12/21/2011 10:30:33 AM PST by st.eqed
[ Post Reply | Private Reply | To 3 | View Replies]

To: ShadowAce
Ah, gotta love them Apple Haters.

The only people in God's Universe more rabid than Apple Cultists.

10 posted on 12/21/2011 10:31:57 AM PST by dayglored (Listen, strange women lying in ponds distributing swords is no basis for a system of government!)
[ Post Reply | Private Reply | To 4 | View Replies]

To: ShadowAce
So who uses Safari as their browser on a Windows OS? I doubt Apple is too concerned about giving priority to that interoperability test.
11 posted on 12/21/2011 10:32:06 AM PST by NonValueAdded ("At a time like this, we can't afford the luxury of thinking!")
[ Post Reply | Private Reply | To 1 | View Replies]

To: discostu

Sounds like an easy fix to me.


12 posted on 12/21/2011 10:35:19 AM PST by BenKenobi (Honkeys for Herman! 10 percent is enough for God; 9 percent is enough for government)
[ Post Reply | Private Reply | To 8 | View Replies]

To: gimme1ibertee

Until something comes out, don’t use Safari.


13 posted on 12/21/2011 10:35:49 AM PST by RJS1950 (The democrats are the "enemies foreign and domestic" cited in the federal oath)
[ Post Reply | Private Reply | To 6 | View Replies]

To: Thane_Banquo

Incorrect. There is a flaw in the kernel allowing user space applications to fault memory, Safari just happens to be the app that has uncovered it.


14 posted on 12/21/2011 10:35:51 AM PST by Michael Barnes (Obamaa+ Downgrade)
[ Post Reply | Private Reply | To 3 | View Replies]

To: NonValueAdded

I use Safari occasionally.

But after upgrading to Safari 5, I began having problems with the computer hanging up and deleted it from my Windows 7 64 bit computer.


15 posted on 12/21/2011 10:37:15 AM PST by Ole Okie
[ Post Reply | Private Reply | To 11 | View Replies]

To: NonValueAdded

For sure.


16 posted on 12/21/2011 10:39:43 AM PST by b4its2late (Only two things are infinite, the universe and human stupidity, and I am not sure about the former.)
[ Post Reply | Private Reply | To 11 | View Replies]

To: dayglored

Are you saying Apple’s Safari is a malicious piece of software?

I agree with you....When you down load an executable, you either give it permission to run on your system or you don’t. The OS cannot protect itself from user inflicted dumbsh!tness.....you ignorant puffed up smidgeon of blowfish sh!t


17 posted on 12/21/2011 10:40:20 AM PST by Electric Graffiti (Crush your enemies, see them driven before you, and hear the lamentation of their Moonbats)
[ Post Reply | Private Reply | To 5 | View Replies]

To: ShadowAce
Exceptionally POOR testing at micro$oft !

18 posted on 12/21/2011 10:44:10 AM PST by Uri’el-2012 (Psalm 119:174 I long for Your salvation, YHvH, Your law is my delight.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: gimme1ibertee

Yeah, that patch is called Linux.


19 posted on 12/21/2011 10:48:46 AM PST by BuckeyeTexan (Man is not free unless government is limited. ~Ronald Reagan)
[ Post Reply | Private Reply | To 6 | View Replies]

To: ShadowAce

So all 3 users of Safari are impacted. Yes this shouldn’t crash the system, but we do need to find out why it is before we blame MS. It will probably be a windows issue, but it is possible that safari introduced it.

Before anyone says a usermode app shouldn’t allow that...we don’t know if Safari did something at ring 0. It’s doubtful but it is possible.


20 posted on 12/21/2011 10:53:52 AM PST by for-q-clinton (If at first you don't succeed keep on sucking until you do succeed)
[ Post Reply | Private Reply | To 1 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-4041-56 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson