Microsoft warns of Windows zero-day flaw

Microsoft has warned of a recently disclosed vulnerability in the CIFS/SMB component of Windows affecting all supported versions of the operating system.

The company said that it first received word of the vulnerability earlier this week when a proof-of-concept sample was disclosed.

The exploit can be remotely activated and could cause a system crash and the infamous 'blue screen' error message.

The vulnerability is being classified by Microsoft as a 'critical' risk, but is not believed to allow remote code execution.

Microsoft researcher Matt Oh said in a posting to the Microsoft Malware Protection Center blog that certain parts of the vulnerable component could consistently be targeted, but causing remote code execution would be extremely difficult.

"Our conclusion is that the part of the string that the attacker can control will always end up inside the allocated buffer, and the part the attacker can't control is in the part that overflows the buffer," he said.

"Also, it is not possible to control the length of data to overwrite, so that it's always the same (and predictable) huge integer value."

Administrators can disable the Browser protocol to mitigate the risk of an attack. Microsoft did not say when a permanent fix will be released. The next scheduled patch is on 8 March.