Microsoft warns of bug in 64-bit Windows 7

Downplays threat with low exploit rating, recommends disabling Aero

Microsoft today warned users of a vulnerability in the 64-bit versions of Windows 7 and Windows Server 2008 R2 that could be used to hijack systems.

The bug is in Windows' Canonical Display Driver, which blends the operating system's primary graphics interface, dubbed Graphics Device Interface (GDI), and DirectX to compose the desktop.

According to Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), the vulnerability affects any machine with the flashy "Aero" interface, which is the default on all but the least-expensive editions of Windows 7. Aero is an optional install on Windows Server 2008 R2.

"If exploited, it would likely cause the affected system to stop responding and restart," said Bryant in an entry on the MSRC blog . "Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)."

However, ASLR, one of the bulwarks of Windows 7's and Vista's security defenses, has been repeatedly bypassed by researchers , including two who won $10,000 cash prizes at the noted Pwn2Own hacking contest in March.

Microsoft gave the bug an exploitability index rating of "3," the lowest of the company's three-step scoring system it uses to predict the likelihood of reliable attack code appearing in the next 30 days. According to that score, Microsoft believes it's unlikely hackers will come up with an exploit in the coming month.

"We're currently developing a security update for Windows that will address the vulnerability," promised Bryant, who did not set a timetable for a patch. In lieu of a fix, users can disable Aero to protect their machines.

Attackers could exploit the vulnerability by tricking users into visiting a malicious site that hosts a rigged image file, Microsoft's advisory warned .

But an attack may require more than that seemingly simple tactic, said Andrew Storms, director of security operations at nCircle Security. "I believe what Microsoft is saying [in the advisory] is that the image viewers from Microsoft won't trigger the vulnerability, but third-party applications may."

To disable Aero, users can click Start, select Control Panel, then click on "Appearance and Personalization," Microsoft said in the advisory. Under "Presentation," users would then click "Change the Theme" and then select one of the "Basic and High Contrast Themes."

Today's advisory is not the only vulnerability not yet patched by Microsoft. A flaw in SharePoint Server 2007 was acknowledged by the company late last month, but remains unfixed.

Microsoft's next security updates are slated for release June 8.

The company won't patch this latest vulnerability that fast, said Storms. "No way," he said via instant message when asked what chance Microsoft has to ready a fix in three weeks. "They are already saying it's difficult to reproduce, [so] it will be a low priority at the moment. But the info is public, so you can bet it's getting eyeballs and things can change rapidly."

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld . Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is .

Read more about security in Computerworld's Security Knowledge Center.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags MicrosoftWindows 7

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments



Victorinox Werks Professional Executive 17 Laptop Case

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?