Vupen security researchers finger Windows 8 holes

November 05, 2012

Vupen, a security company in the business of selling zero-day vulnerabilities, said it has found a way to bypass security mechanisms on Windows 8 and execute code via a Web page. Vupen Chief Executive Chaouki Bekrar said in an email Friday that the company's researchers had found "multiple vulnerabilities" in Windows 8 and Internet Explorer 10, the latest version of Microsoft's operating system and Web browser. (See also PCWorld's review of Windows 8). "We have researched and discovered multiple vulnerabilities in Windows 8 and Internet Explorer 10 that we have combined together to achieve a full remote code execution via a Web page which bypasses the new exploit-mitigation technologies included in Win8," he said. Microsoft declined comment on Bekrar's email, saying that it had not received any details of the flaws. "We continue to encourage researchers to participate in Microsoft's Coordinated Vulnerability Disclosure program to help ensure our customers' protection," Dave Forstrom, director of Microsoft Trustworthy Computing, said in a statement. To read this article in full or to leave a comment, please click here

Link: http://www.csoonline.com/article/720627/Vupen_claims_'remote_code_execution'_on_Windows_8