Windows hole discovered after 17 years

This is Tavis's "thing" (one of them, at least); he's better known for fuzzing the device virtualization code in VMware and Xen and finding hypervisor escapes. I'm not even a little surprised that he found privilege escalation in VDM.<p>It's a cool bug, but it's a bit strange to see it get written up like this, because it doesn't matter a whole lot. On most Windows machines, if you have a normal user account, you have everything you need; in corporate environments, if you have one admin password you probably have all of them; in servers, the user account you bust is probably a local admin.

"Discovered" or "finally made public" after 17 years. Security holes are in a lot of things, but I can't believe that this wasn't found sooner by people who would use it for nefarious purposes and kept under wraps.

It's also interesting that the exploit was found by a Google employee who was designated #1 in the top 15 Most Influential People in Security. <a href="http://www.eweek.com/c/a/Security/The-15-Most-Influential-People-in-Security-Today/1/" rel="nofollow">http://www.eweek.com/c/a/Security/The-15-Most-Influential-Pe...</a><p>With the resources both Google and Microsoft have at their disposal, I wonder if it's worth having a few employees discovering security flaws in your opponent's platform.

I wonder if this affects OS/2 as well.

Their update states that their is no Group Policy Manager outside of Windows 2003 - however the "God Mode" hack for Windows 7 supplies this option without the need for messing with registry keys. Just create a folder on the desktop with the name "GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}" and the Group Policy Manager can be access under "Administrative Tools".

What else did they find? That DOS has problems with memory management?<p>Advances in technology are bound to expose flaws in older products, so what's the news here?