Attackers Could Bypass XP SP2 Security Mechanisms

Microsoft Corp. on Monday confirmed it was investigating a claim by a Russian security researcher that two key security technologies built into Windows XP Service Pack 2 could be easily defeated.

The weaknesses were highlighted in a research paper published by Alexander Anisimov of Positive Technologies and centers around XP SP2’s heap protection and DEP (data execution prevention) security mechanisms.

According to Anisimov, malicious hackers could bypass the two security mechanisms to execute arbitrary code on Windows systems running XP SP2. A successful attack could also allow arbitrary memory region write access (smaller or equal to 1016 bytes) and DEP bypass.

Microsoft is disputing the crux of the researcher’s claim, insisting it is not a security vulnerability.

“An attacker cannot use this method by itself to attempt to run malicious code on a user’s system. There is no attack that utilizes this, and customers are not at risk from the situation,” a spokesperson for the software giant told eWEEK.com.

She said the two security technologies built into XP SP2 are meant to make it more difficult for an attacker to run malicious software on the computer as the result of a buffer overrun vulnerability.

“It’s important to note that data execution protection and heap overflow protection were never meant to be foolproof; the purpose of these features is to make it more difficult for an attacker to run malicious software on the computer as the result of a buffer overrun,” she said.

IT pros are still cautious about deploying XP SP2. Click here to read more.

Officials at the Microsoft Security Research Center plan to modify the technologies to address the reported weaknesses.

The primary benefit of DEP is to help prevent code execution from data pages. In XP SP2 and Microsoft Windows XP Tablet PC Edition 2005, DEP is enforced by hardware and by software.

Hardware-enforced DEP detects code that is running from these locations and raises an exception when execution occurs. Software-enforced DEP can help prevent malicious code from taking advantage of exception-handling mechanisms in Windows.

Execution protection, or NX (no execute), prevents code execution from data pages such as the default heap, various stacks and memory pools. Protection can be applied in both user- and kernel mode.

Check out eWEEK.com’s for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer’s Weblog.