http://www.eweek.com/article2/0,1759,1757786,00.asp By Ryan Naraine January 31, 2005 Microsoft Corp. on Monday confirmed it was investigating a claim by a Russian security researcher that two key security technologies built into Windows XP Service Pack 2 could be easily defeated. The weaknesses were highlighted in a research paper [1] published by Alexander Anisimov of Positive Technologies and centers around XP SP2's heap protection and DEP (data execution prevention) security mechanisms. According to Anisimov, malicious hackers could bypass the two security mechanisms to execute arbitrary code on Windows systems running XP SP2. A successful attack could also allow arbitrary memory region write access (smaller or equal to 1016 bytes) and DEP bypass. Microsoft is disputing the crux of the researcher's claim, insisting it is not a security vulnerability. "An attacker cannot use this method by itself to attempt to run malicious code on a user's system. There is no attack that utilizes this, and customers are not at risk from the situation," a spokesperson for the software giant told eWEEK.com. She said the two security technologies built into XP SP2 are meant to make it more difficult for an attacker to run malicious software on the computer as the result of a buffer overrun vulnerability. "It's important to note that data execution protection and heap overflow protection were never meant to be foolproof; the purpose of these features is to make it more difficult for an attacker to run malicious software on the computer as the result of a buffer overrun," she said. Officials at the Microsoft Security Research Center plan to modify the technologies to address the reported weaknesses. The primary benefit of DEP is to help prevent code execution from data pages. In XP SP2 and Microsoft Windows XP Tablet PC Edition 2005, DEP is enforced by hardware and by software. Hardware-enforced DEP detects code that is running from these locations and raises an exception when execution occurs. Software-enforced DEP can help prevent malicious code from taking advantage of exception-handling mechanisms in Windows. Execution protection, or NX (no execute), prevents code execution from data pages such as the default heap, various stacks and memory pools. Protection can be applied in both user- and kernel mode. [1] http://www.maxpatrol.com/defeating-xpsp2-heap-protection.htm _________________________________________ Bellua Cyber Security Asia 2005 - http://www.bellua.com/bcs2005
This archive was generated by hypermail 2.1.3 : Tue Feb 01 2005 - 02:40:05 PST