News

Microsoft Under Fire for Patch Delay

• By Scott Bekker
• February 11, 2004

The patch Microsoft released on Tuesday for one of the most severe flaws yet discovered in Windows has the company under renewed scrutiny about the length of time it takes to fix security problems.

The flaw involves Microsoft's Abstract Syntax Notation One (ASN.1), a data standard used by applications and devices for allowing normalization and understanding of data across platforms. The flaw is present in Windows NT, Windows 2000, Windows XP and Windows Server 2003 and can allow remote code execution.

While Microsoft has greatly improved the quality of its software from a security perspective over the last two years, security experts view the current problem as extremely severe. Even well-secured networks are vulnerable if the patch isn't in place on its machines, and the vulnerability is ripe for automated remote exploitation.

But the bigger complaint in this case involves Microsoft's apparently sluggish response. The firm that discovered the flaw, eEye Digital Security, revealed on Tuesday that it first alerted Microsoft about the problem in July, more than six months before Microsoft managed to produce a patch. "We contacted Microsoft about these vulnerabilities 200 days ago, which is insane," eEye co-founder Marc Maiffret told Reuters.

Microsoft officials countered that the pervasiveness of the vulnerability in its software required extra time and investigation to do the fix properly.

The issue adds to a controversy already brewing about Microsoft's two-month delay in getting a fix out for a URL spoofing problem in Internet Explorer. Microsoft posted a workaround in December, but didn't produce a patch until last week.

The combination of the ASN.1 delay and the Internet spoofing delay could resuscitate a debate that Microsoft had largely put to rest about whether it was more responsible for security researchers to immediately publicize flaws they find or work secretly with vendors to fix the flaws before announcing them.

Maiffret's public venting about Microsoft's sluggishness could be a sign that the most aggressive and prolific bug-hunting security firms are losing patience with Microsoft's process.