Microsoft releases emergency patch for Windows 7
Microsoft released an out of band emergency patch for a vulnerability in Windows 7 and Windows Server 2008. This was necessary after a security researcher discovered that a Meltdown-patch released in January this year, introduced a new and even bigger vulnerability.
The patch released in January should have protected Windows 7 and Windows Server 2008 systems against the Meltdown attack writes myce. Unfortunately the update introduced a new vulnerability that allowed any random process to read the entire system’s memory and to write data to it. Security researchers Ulf Frisk discovered the new issue and according to him the vulnerability is fairly easy to exploit.
Microsoft reports the vulnerability allowed a logged in attacker to use a specially crafted application to take control of an affected system. “An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” Microsoft further explains.
Therefore, Microsoft decided to release an emergency patch outside its regular Patch Tuesday release-cycle. The software giant strongly advises users to install the update as soon as possible. Microsoft hasn’t discovered any attacks exploiting the vulnerability in the wild yet, but the company expects that’s only a matter of time.
Microsoft will Increase Windows license fees for high-end hardware - 03/30/2018 07:12 AM
It has been mentioned before, different Windows 10 licensing models based on the hardware you use. Currently, there is wordout on the street that Microsoft plans to raise license fees for computers wi...
Microsoft DirectX Raytracing - EA Real-time Raytracing Experiment - 03/20/2018 08:12 AM
EA also shared a video demoing Real-time Raytracing. PICA PICA' is a demo and experiment using SEED's 'Halcyon' research engine and Microsoft's new DirectX Raytracing API to do real-time GPU ray...
Microsoft announces DirectX Raytracing for real-time raytracing - 03/20/2018 07:46 AM
Shortly after the Nvidia announcement, Microsoft follows by adding DirectX Raytracing to the DirectX 12 api. According to the manufacturer, the technology clears the way for games that are partly buil...
Microsoft DirectX Raytracing - Remedy Example Video - 03/20/2018 07:46 AM
Remedy Entertainment discussed the experiments and research we have done in collaboration with Nvidia on the Microsoft DirectX Raytracing (DXR) API that enables straightforward access to real-time ray...
Intel and Microsoft release final Spectre Patches up to and including Sandy Bridge - 03/15/2018 03:24 PM
As Intel finalizes them, Microsoft started distributing Microcode updates for the Spectre variant 2, the updates now have a reach from the latest Coffee Lake processors, Kaby Lake (Core iX-7xxx and iX...
Senior Member
Posts: 320
Joined: 2014-12-09
If I secure my BIOS with a password, shouldn't i be secure from some of this exploits?
Senior Member
Posts: 11503
Joined: 2012-07-20
It was a joke from my side. Writing code which works at boot time and still allows normal system operation is not that easy in limited space of BIOS flash. So it is one of last targets attacker has on list. (If it even gets to list as each MB requires different BIOS and has different kinks which may prevent system from being operational and therefore lost even to attacker himself.)
Meltdown/spectre and similar are not spawning from BIOS therefore password on BIOS does not protect against them. (OS level attacks.)
But in case they allow attacker to gain control over your system, you do not need BIOS-Admin-Password. You need settings preventing BIOS flashing from OS.
Senior Member
Posts: 12622
Joined: 2003-05-11
Link to the patch in the catalog ?
Senior Member
Posts: 151
Joined: 2017-09-12
Has anyone even been affected by it? I haven't updated my Windows 7 since 2012 and have never had any issues.
Senior Member
Posts: 11503
Joined: 2012-07-20
And they forgot to mention that attacker may as well flash BIOS (unless flash protected form OS), to have full list of "popular" exploits these days...
...as it seems that flashing BIOS is most important thing attacker wants to do once he has control over system.