An anonymous hacker claims to have uncovered a critical security flaw in the software that runs Microsoft's Xbox 360 that could allow an attacker to take control of the system.
Microsoft has acknowledged the vulnerability and issued a patch on 9 January. The hacker demonstrated the vulnerability in December, but has only now provided details on how to exploit the flaw on the Full Disclosure security email list.
...
...Microsoft introduced the flaw through the 4532 kernel update on 31 October that was automatically distributed to all Xbox 360 systems with an internet connection through the Xbox Live service...
...Users can manually download the patch by connecting to Xbox Live. Users of systems without an internet connection can obtain the update by manually downloading a patch to a PC, burning it to a CD and inserting it into the console.
This first proof of concept software utilises the shader hole found in the King Kong game sometime ago, of which the INQ has reported on several times in Monday morning weekly gameing round-ups.
This isn't a hack the average user can easily attempt. It'll require the King Kong game, a modified DVD firmware (widely used to allow back-up ISOs to run on the 360), and also will require users to connect the serial port of the Xbox 360, compile the code from sources and most important of all will need users to have kernel 4532 or 4548 (most of whom are probably already updated to the patched 4552 kernel).
