Microsoft on Friday said it is working on a fix for a vulnerability in the Server Message Block file-sharing protocol in Windows 7 and Windows Server 2008 Release 2 that could be used to remotely crash a computer.

The software giant had said on Wednesday that it was looking at the bug, discovered by researcher Laurent Gaffié, who published proof-of-concept code on a blog.

“Microsoft is aware of public, detailed exploit code that would cause a system to stop functioning or become unreliable. If exploited, this [denial-of-service] vulnerability would not allow an attacker to take control of, or install malware on, the customer’s system but could cause the affected system to stop responding until manually restarted,” Dave Forstrom, group manager for public relations at Microsoft Trustworthy Computing, said in a statement. “It is important to note that the default firewall settings on Windows 7 will help block attempts to exploit this issue.”

Microsoft is not aware of attacks to exploit the hole at this time, he said.

In an advisory, Microsoft criticized the way Gaffié handled the discovery.

“Microsoft is concerned that this new report of a vulnerability was not responsibly disclosed, potentially putting computer users at risk,” the advisory said. “We continue to encourage responsible disclosure of vulnerabilities.”

The advisory suggests that customers block Transmission Control Protocol, or TCP, ports 139 and 445 at the firewall, as a workaround until a patch is ready.

Microsoft on Tuesday issued six security bulletins fixing 15 vulnerabilities, including a critical patch for holes in the Windows kernel and other Windows and Office components that could allow an attacker to take control of a computer.

The critical bulletin affecting the Kernel-Mode Drivers was publicly disclosed and could be used to create a Web page with malware designed to exploit the hole on systems that visit the page, Microsoft said in a blog posting.

“MS09-065, a bug in the Windows kernel, is this month’s most serious issue,” said Andrew Storms, director of security operations at nCircle. “The vulnerability allows for remote code execution, and the attack code can be embedded inside MS Office files or be hosted on websites. Simply browsing an infected website will compromise unsuspecting users — not great for all the holiday shoppers looking to get a jump on their shopping. The novelty value of this bug is likely to attract many researchers. A lot of people will try to be the first to publicly post exploit code.”

The two other critical bulletins fix holes in Web Services on Devices API and in License Logging Server. Two bulletins ranked “important” fix holes that pose risk of remote code execution if a user opened a maliciously crafted Excel or Word file.

“It is interesting that a new service that helps with the ‘user experience’ can cause so much harm,” said Jason Miller, data and security team leader at Shavlik Technologies. “The WSDAPI service allows users to easily find devices such as printers and cameras on their network. This vulnerability is also not publicly known at this time.”

Software affected by the patches includes Windows 2000, XP, Server 2003, Vista, Server 2008, Office XP, Office 2003, 2007 Microsoft Office System, Office 2004 for Mac, and Office 2008 for Mac, according to the bulletin.

Meanwhile, the Microsoft Malware Protection Center team added two rogue antivirus families to the Malicious Software Removal Tool — Win32/FakeVimes, which calls itself “Windows System Defender” and “Windows Enterprise Suite,” and Win32/PrivacyCenter, which calls itself “Safety Center.”