News

Microsoft Under Fire for Patch Delay

The patch Microsoft released on Tuesday for one of the most severe flaws yet discovered in Windows has the company under renewed scrutiny about the length of time it takes to fix security problems.

The flaw involves Microsoft's Abstract Syntax Notation One (ASN.1), a data standard used by applications and devices for allowing normalization and understanding of data across platforms. The flaw is present in Windows NT, Windows 2000, Windows XP and Windows Server 2003 and can allow remote code execution.

While Microsoft has greatly improved the quality of its software from a security perspective over the last two years, security experts view the current problem as extremely severe. Even well-secured networks are vulnerable if the patch isn't in place on its machines, and the vulnerability is ripe for automated remote exploitation.

But the bigger complaint in this case involves Microsoft's apparently sluggish response. The firm that discovered the flaw, eEye Digital Security, revealed on Tuesday that it first alerted Microsoft about the problem in July, more than six months before Microsoft managed to produce a patch. "We contacted Microsoft about these vulnerabilities 200 days ago, which is insane," eEye co-founder Marc Maiffret told Reuters.

Microsoft officials countered that the pervasiveness of the vulnerability in its software required extra time and investigation to do the fix properly.

The issue adds to a controversy already brewing about Microsoft's two-month delay in getting a fix out for a URL spoofing problem in Internet Explorer. Microsoft posted a workaround in December, but didn't produce a patch until last week.

The combination of the ASN.1 delay and the Internet spoofing delay could resuscitate a debate that Microsoft had largely put to rest about whether it was more responsible for security researchers to immediately publicize flaws they find or work secretly with vendors to fix the flaws before announcing them.

Maiffret's public venting about Microsoft's sluggishness could be a sign that the most aggressive and prolific bug-hunting security firms are losing patience with Microsoft's process.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.