News

Microsoft Under Fire for Patch Delay

The patch Microsoft released on Tuesday for one of the most severe flaws yet discovered in Windows has the company under renewed scrutiny about the length of time it takes to fix security problems.

The flaw involves Microsoft's Abstract Syntax Notation One (ASN.1), a data standard used by applications and devices for allowing normalization and understanding of data across platforms. The flaw is present in Windows NT, Windows 2000, Windows XP and Windows Server 2003 and can allow remote code execution.

While Microsoft has greatly improved the quality of its software from a security perspective over the last two years, security experts view the current problem as extremely severe. Even well-secured networks are vulnerable if the patch isn't in place on its machines, and the vulnerability is ripe for automated remote exploitation.

But the bigger complaint in this case involves Microsoft's apparently sluggish response. The firm that discovered the flaw, eEye Digital Security, revealed on Tuesday that it first alerted Microsoft about the problem in July, more than six months before Microsoft managed to produce a patch. "We contacted Microsoft about these vulnerabilities 200 days ago, which is insane," eEye co-founder Marc Maiffret told Reuters.

Microsoft officials countered that the pervasiveness of the vulnerability in its software required extra time and investigation to do the fix properly.

The issue adds to a controversy already brewing about Microsoft's two-month delay in getting a fix out for a URL spoofing problem in Internet Explorer. Microsoft posted a workaround in December, but didn't produce a patch until last week.

The combination of the ASN.1 delay and the Internet spoofing delay could resuscitate a debate that Microsoft had largely put to rest about whether it was more responsible for security researchers to immediately publicize flaws they find or work secretly with vendors to fix the flaws before announcing them.

Maiffret's public venting about Microsoft's sluggishness could be a sign that the most aggressive and prolific bug-hunting security firms are losing patience with Microsoft's process.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Offers Support Extensions for Exchange 2016 and 2019

    Microsoft has introduced a paid Extended Security Update (ESU) program for on-premises Exchange Server 2016 and 2019, offering a crucial safety cushion as both versions near their Oct. 14, 2025 end-of-support date.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Notebook

    Microsoft Centers AI, Security and Partner Dogfooding at MCAPS

    Microsoft's second annual MCAPS for Partners event took place Tuesday, delivering a volley of updates and directives for its partners for fiscal 2026.

  • Microsoft Layoffs: AI Is the Obvious Elephant in the Room

    As Microsoft doubles down on an $80 billion bet on AI this fiscal year, its workforce reductions are drawing scrutiny over whether AI's ascent is quietly reshaping its human capital strategy, even as official messaging avoids drawing a direct line.