Ms Security Concern

[A_Traveller]

Though it's too early to be definitive about this, two security researchers Mark Dowd {IBM} and Alexander Sotirov {VMware} appear to have constructed a relatively easy to use technique to inject active objects {even .Net} into any memory space within Vista {no mention of other OS'} from a browser using the way IE {and I'd think other browsers as well} deal with active scripting.

I'll follow up on this when more data is to hand, but it would appear to be a serious flaw which would be exploitable within the Vista security infrastructure, even the ASLR.

LINK

Just to be clear I'm not criticising MS here, it looks like someone has found a way to break the additional security within some core elements of Vista, but to what degree the user has to act I can't say at this stage, nor can I say with certainty if the exploit could be used on other environments {my guess is that it could}

Regards

/edit add last para//

Edited August 8, 2008 by A_Traveller