Risk: Informational
Microsoft is downplaying the significance of research that suggests support for revamped memory protection in Win XP SP2 will fail to block a common type of security attack. Alexander Anisimov of Russian security firm Positive Technologies has published a paper explaining how the Data Execution Protection (DEP) and heap overflow protection features that debuted in Windows XP SP2 can be bypassed.
This execution protection (NX) technology, which is only supported by a limited number of processors including AMD K8, Intel Itanium and some Xeon processors, is designed to thwart buffer overrun attacks. Buffer overflows are a perennial source of software security problems that often feature in Windows security exploits. The infamous Sasser worm, for example, used a buffer overflow flaw in Windows' Local Security Authority Subsystem Service to spread.
Microsoft's NX protection is designed to make it more difficult for crackers to inject malicious code into memory, but Positive Technologies' MaxPatrol security scanner research team found a chink in these defences, outlined in Anisimov's paper.
Positive Technologies said it discovered the problem in October 2004, notified Microsoft in December and went public in February 2005. In a statement, Microsoft said that "early analysis" indicates that attempts to bypass its newly-introduced memory protection technology are "not a security vulnerability". It said it never claimed the technology was foolproof.
"An attacker cannot use this method by itself to attempt to run malicious code on a user's system. There is no attack that utilizes this, and customers are not at risk from the situation," it said.
"It's important to note that DEP and heap overflow protection are not designed to protect against all kinds of malicious code exploits. These features effectively address the exploits that they were designed to prevent and make it more difficult for an attacker to run malicious software on the computer as the result of a buffer overrun. We will continue to modify these technologies as appropriate to improve them and will evaluate ways to mitigate against this method of bypass while retaining performance on the system, either through an update as part of our monthly bulletin release process, or in a service pack," it added.
Microsoft continues to urge customers to load Windows XP Service Pack 2 as a defence against security attacks.