On Tue, Jan 19, 2010 at 9:56 PM, Cameron Kaiser <spectre at floodgap.com>wrote: I thought Microsoft nixed the old DOS routines, along with the OS/2 compatibility layer, in Windows XP? It's near-insanity to keep those low level routines around this long - they should have been virtualized a long time ago. Heck, DOSBox runs DOS software better than the console nowadays.

Cameron Kaiser wrote: Hey, I can handle it :). Interesting bug. I'm not a kernel hacker and I don't know the details of how the NTVDM works all that well, but I'm surprised that the CreateRemoteThread() call on the VDM subsystem required for the exploit would actually work if you weren't already an Administrator. (In which case an app running locally can already own the box in any number of other ways). NTVDM and 16-bit support in general have been removed from 64-bit SKUs of Windows, starting with the 64-bit edition of XP. I miss it sometimes, but there's always VirtualPC/VirtualBox/VMWare or the trusty PS/2 model 80 I have sitting over here... ;) (My favorite Windows bug has to be the csrss backspace bug (Fixed in Vista!) : http://www.juniper.net/security/auto/vulnerabilities/vuln3478.html) - Josh