Microsoft tweaks Windows Vista security

The security adjustments are designed to prevent buffer overflow attacks

Microsoft has tweaked the security settings of its forthcoming Windows Vista operating system, vnunet.com has learned. 

Some security features in the latest Windows Vista Release Candidate 2 have been disabled, while others that were previously switched off have been activated, Marc Maiffret, chief technology officer at security vendor eEye, told vnunet.com. 

The security features are designed to prevent buffer overflow attacks triggered when an attacker attempts to store data beyond the boundaries of a fixed length buffer. 

This can result in an application crash or, in some cases, allow an attacker to take control of a system.

Security settings that are too stringent, however, can prevent existing applications from functioning normally.

Microsoft has designed numerous security technologies for Windows Vista. Activating different combinations allows the software giant to strike a balance between application compatibility and optimal levels of security.

"Even the final version of Windows Vista will have variations [from the current RC2]," said Maiffret. "Microsoft will change how it is configured by default and how the different layers are going to be enabled by default."

Stringent buffer overflow protections affect applications that use memory in non-standard ways. Some games, for instance, are designed to execute video buffering to achieve better graphics performance.

The changes are noticeable because Microsoft does not typically make any large adjustments to its software after Release Candidate 1. Changes to the software can lead to compatibility issues with third-party applications and hardware devices.

Windows Vista will be made available to PC manufacturers and large enterprises in November. The consumer launch is scheduled for January 2007.

A spokesman for Microsoft stressed that the changes do not affect end users. The company did not follow up on a promise to provide further information on the security changes in RC2.