Last Thursday came an acknowledgement from Microsoft that it had made an error when writing Windows, which had led to a security hole being left wide open in the code associated with its Server Message Block 2 file-and-print-sharing protocol which ships with Windows Vista, Windows 7 and Windows Server 2008.

More specifically, the error appears in two array references to ValidateRoutines[] . array index to both is the wrong variable: pHeader->Command should be pWI->Command.

The MS09-050 security bulletin released Tuesday states that as a result, "An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

This code error was missed despite checks, in Windows Vista, and has only recently been detected by using a process known as fuzzing – subjecting software to a wide range of data input to see if, and where, it breaks. The bug was recently detected very late  in the Windows 7 development process, and although it did appear both in the beta and Release Candidate versions of 7, it has been patched in the RTM copies of Windows 7, due for sale later this month. (October 2009)

Microsoft has now patched this vulnerability in its biggest-yet Patch Tuesday on 13th October 2009. Both independent analysts and Microsoft themselves have advised all users to put the MS09-050 patches on a high-priority list, as some exploit-code is already in the public domain, and other exploit code with a bigger sting in its tail will most likely follow.