Windows 7 zero-day flaw reported by researcher
Windows 7 escaped unscathed from November's patch day, but it looks like a zero-day vulnerability has already been found.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
A security researcher has posted details of what he says is a zero-day vulnerability in Windows 7.
Laurence Gaffi posted proof of concept code of the vulnerability, which he said was able to remotely crash Windows 7 or Windows Server 2008 R2 on a local area network (LAN), or through Internet Explorer (IE).
On his blog, he stated that the bug triggered an infinite loop' on the server message block (SMB), a network file sharing protocol, without any authorisation or credentials needed.
He said that the bug was proof that Microsoft's security development lifecycle (SDL), a software development process that was encouraged to increase reliability, had failed.
Gaffi also mocked any belief that Windows 7 was the most secure operating system ever', saying: "Whatever your firewall is set to, you can get remotely smashed via IE or even via some broadcasting NBNS (NetBIOS Name Server) tricks."
"How funny," he added.
As there was no patch available, he recommended users close their SMB feature and ports, until a real audit is provided.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
He claimed that he contacted the Microsoft Security Response Centre (MSRC) last week about the flaw, and that it acknowledged there was a problem.
Microsoft said in a statement that it was aware of rumours of a security bug affecting Windows 7 and Windows Server 2008 R2, and was currently investigating.
"New developments such as this security bug are taken very seriously and Microsoft will advise customers on the next steps following the investigation," it said.
Security researchers have already warned that Windows 7 is just as vulnerable to attack as previous systems.
-
Organizations hit by 90 zero-day vulnerabilities last yearNews Google Threat Intelligence researchers warn that edge devices and security appliances are prime entry points
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Two Fortinet vulnerabilities are being exploited in the wild – patch nowNews Arctic Wolf and Rapid7 said security teams should act immediately to mitigate the Fortinet vulnerabilities

