N卡驱动被曝严重漏洞

clawhammer

http://www.techpowerup.com/177540/AMD-to-Get-Rid-of-Catalyst-Auto-Update-Feature-in-2013-Cites-Security-Concerns.html

AMD to Get Rid of Catalyst Auto-Update Feature in 2013, Cites Security Concerns

It looks like somebody found a security vulnerability in the auto-update feature of AMD Catalyst Control Center (CCC), which notifies you of updates to Catalyst system software and directs you to the download page. AMD announced that it plans to discontinue the feature starting in 2013, and recommends that you get your driver updates the old-fashioned way: by keeping up with the news and getting your drivers from the internet. Due to the severity of the exploit, AMD recommended users to disable auto-updates in their current CCC configuration, or click on "skip" whenever it prompts you to update drivers. AMD stated:
AMD will be removing the auto-update notification functionality from versions of AMD Catalyst Control Center running under Windows Vista, Windows 7 and Windows 8, beginning in early 2013. Due to a minor security vulnerability in the auto-update notification, users are recommended to update to the latest AMD Catalyst driver release from the amd.com web site. Alternatively, users should (i) uncheck the "Automatically check for updates" option under AMD Catalyst Control Center > Information > Software Update, and (ii) choose to "Skip" notifications from the AMD Catalyst driver, which notifications recommend updating to the latest driver.

clawhammer

国内的小编就会添油加醋
这是原文


An [ethical?] hacker going by the Twitter handle @peterwintrsmith discovered a gaping security hole in NVIDIA's display driver service that allows ordinary local and remote users to gain administrator privileges in Windows. Mr. Winter-Smith posted a description and details of the exploit, in which he describes the NVIDIA Display Device server (NVVSVC) as listening on a pipe (a means by which different processes talk to each other) "pipensvr," which has an null/empty discretionary access control list (DACL, a security whitelist for users/groups), letting ordinary logged in local and remote users (firewall permitting, and the remote admin has a local account) to gain administrator rights to the system. In our opinion, the exploit is plausible, and could cut short winter breaks of a few in Santa Clara.

justwater

撸主干净百度翻译，我看好你哟。

jocover

要的自己拿去玩吧