News

Microsoft Under Fire for Patch Delay

The patch Microsoft released on Tuesday for one of the most severe flaws yet discovered in Windows has the company under renewed scrutiny about the length of time it takes to fix security problems.

The flaw involves Microsoft's Abstract Syntax Notation One (ASN.1), a data standard used by applications and devices for allowing normalization and understanding of data across platforms. The flaw is present in Windows NT, Windows 2000, Windows XP and Windows Server 2003 and can allow remote code execution.

While Microsoft has greatly improved the quality of its software from a security perspective over the last two years, security experts view the current problem as extremely severe. Even well-secured networks are vulnerable if the patch isn't in place on its machines, and the vulnerability is ripe for automated remote exploitation.

But the bigger complaint in this case involves Microsoft's apparently sluggish response. The firm that discovered the flaw, eEye Digital Security, revealed on Tuesday that it first alerted Microsoft about the problem in July, more than six months before Microsoft managed to produce a patch. "We contacted Microsoft about these vulnerabilities 200 days ago, which is insane," eEye co-founder Marc Maiffret told Reuters.

Microsoft officials countered that the pervasiveness of the vulnerability in its software required extra time and investigation to do the fix properly.

The issue adds to a controversy already brewing about Microsoft's two-month delay in getting a fix out for a URL spoofing problem in Internet Explorer. Microsoft posted a workaround in December, but didn't produce a patch until last week.

The combination of the ASN.1 delay and the Internet spoofing delay could resuscitate a debate that Microsoft had largely put to rest about whether it was more responsible for security researchers to immediately publicize flaws they find or work secretly with vendors to fix the flaws before announcing them.

Maiffret's public venting about Microsoft's sluggishness could be a sign that the most aggressive and prolific bug-hunting security firms are losing patience with Microsoft's process.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • FTC Expands Microsoft Antitrust Investigation Under Trump Administration

    The Federal Trade Commission (FTC) is pressing ahead with a broad investigation into Microsoft's business practices, an inquiry that began in the final weeks of the Biden administration.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Microsoft to Shut Down Skype Services

    Microsoft will discontinue its Skype telecommunications and video calling services on May 5, 2025, marking the end of the platform's decades-long run.

  • Big Blue To Acquire Datastax in Enterprise AI Play

    In a bid to bolster its enterprise-aimed AI capabilities, IBM is planning to acquire Datastax, a leading AI and data solutions provider, for an undisclosed amount.