Microsoft Confirms 17 Year-Old Bug in Windows

Microsoft released a security advisory to acknowledge a flaw that affects every release of the Windows NT kernel, from Windows NT 3.1 up to and including Windows 7.

The flaw was first exposed by code released by Tavis Ormandy, a Google security researcher, who said that Microsoft was first notified about the issue back in June 2009, but after not seeing fixes and waiting several months he decided it was in the best interest of everyone to go public.

Hackers with valid logon credentials could exploit this vulnerability to run arbitrary code in kernel mode, warned Microsoft. "An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

Windows' 64-bit versions are not vulnerable to attack.

Ormandy affirmed that the vulnerability goes back nearly 17 years to Windows NT 3.1's released in 1993, and exists in every version of Windows including Windows 7 (released in 2009).