A security researcher at Google is recommending computer users make several
configuration changes to protect themselves against a previously unknown
vulnerability that allows untrusted users to take complete control of systems
running most versions of Microsoft Windows.
The vulnerability resides in a feature known as the Virtual DOS Machine,
which Microsoft introduced in 1993 with Windows NT, according to
this writeup penned by Tavis Ormandy of Google. Using code written for the
VDM, an unprivileged user can inject code of his choosing directly into the
system's kernel, making it possible to make changes to highly sensitive parts of
the operating system.
"You can in theory write to memory segments that are otherwise considered
highly trusted and sensitive," said Tom Parker, a director in the security
consulting services group at Securicon, a Washington, DC-based security practice.
"So for example, malware could possibly use it to install a key logger."
