Forum latest

Microsoft Reveals First Vista Gadget Bugs
General
Written by Daniel   
Thursday, 16 August 2007 10:56

Microsoft Reveals First Vista Gadget Bugs
Microsoft patched several Windows Vista gadgets this week, the first time it's had to fix the small applications.
Gregg Keizer, Computerworld
Wednesday, August 15, 2007 2:00 PM PDT

 Microsoft Corp. Tuesday patched several Windows Vista gadgets, the first time it's had to fix the small applications, prompting one researcher to mark the date as the real "arrival of the next-generation of vulnerabilities."

The three bugs detailed in one of the nine bulletins issued Tuesday could let attackers inject their own malicious code into a victim's Vista-powered PC, said Microsoft. Three of Vista's bundled gadgets -- the small applications that sit on the desktop, usually pulling information from other programs or off the Web -- are flawed: the RSS, contacts and weather gadgets. The vulnerabilities in the RSS and weather gadgets are particularly dangerous, since both are enabled by default in a standard Vista installation.

 

"If a user subscribed to a malicious RSS feed in the Feed Headlines Gadget or added a malicious contacts file in the Contacts Gadget or a user clicked on a malicious link in the Weather Gadget an attacker could potentially run code on the system," Microsoft reported in the bulletin.

Although the bugs can result in remote code executing on the target machine -- a characteristic that usually pegs the vulnerability as "critical" -- Microsoft ranked them one step lower, as "important," in part because Vista's revised account rights settings should deflect the worst kind of damage.

Most third-party researchers, however, fixed attention not so much on the bugs themselves but on the fact that they lived inside Vista's gadgets.

"Six months ago, around the time of Vista [release] we started talking about the new types of vulnerabilities we might see," said Amol Sarwate, the manager of Qualys' vulnerability research lab. "These vulnerabilities are a testament that this next generation has finally arrived."  More

Comment in the Forums.

 

 

 

See also

None found.


Hardware | Windows | Linux | Security | Mobile Devices | Gaming
Tech Business | Editorial | General News | folding@home

Forum | Download Files

Copyright ©2001 - 2012, AOA Forums.  All rights reserved.

Alliance of Overclocking Arts

Links monetized by VigLink

Don't Click Here Don't Click Here Either