Feeds

Zero-day WMF flaw underscores patch problems

Countdown to what?

Reducing security risks from open source software

For four days in January, network administrators and security-savvy home users had a choice: download and install an unofficial open-source fix for the critical flaw in the Windows Meta File (WMF) format, or wait an estimated week for an official patch from Microsoft.

With security experts warning about the spread of exploits for the flaw in Microsoft's Windows operating system, tens of thousands of people downloaded the patch from the website of security software developer Ilfak Guilfanov and other websites that hosted the file, according to numbers provided to SecurityFocus.

The quick release of the patch showed the power of community-created code, but also the pitfalls. While source code accompanied the patch and Guilfanov made it easy to uninstall, the decision to install the patch came down to a single question: did the user trust the software developer, Ilfak Guilfanov?

"The patch was caveat emptor - let the patcher beware," said Richard Ford, associate professor of computer science at the Florida Institute of Technology. "Users are not sophisticated. It is hard for them to tell the difference between a genuine third-party patch developed by a white hat, and a program created by a black hat that looks like a patch."

A day later, several security groups vouched that the patch did what Guilfanov said it did, reducing the risk of an untrustworthy patch. Yet, even the patch's creator recognized the inherent problems in the situation. Having to make a decision about whether to trust a third-party patch should not be necessary in order to protect systems.

"As a general rule, (third-party patches) should not be applied," Guilfanov said. "The current situation was, in my perception, a bit different. First there was the danger, then I saw a relatively simple and clean, risk-free fix. If I could help my knowledgeable audience - who could do their own testing - why not? People are postings exploits all the time, why not post a solution for a change?"

The unofficial patch debate underscored the problems with relying on software fixes to secure systems. While Microsoft released its official patch for the problem last Thursday - five days early - attackers had already started using the vulnerabilities in the Windows Meta File (WMF) format - putting the vast majority of users at risk. The situation emphasized the fact that neither Microsoft's patches nor community-created fixes will ever be able to defeat the threat of a zero-day attack.

"Speeding up the patch process is never going to solve the problem, it is never going to be fast enough," the Florida Institute of Technology's Ford said. "We need to be investing very heavily in zero-day defenses, because another zero-day will happen. There is a lot of talk about whether (the software vendor has) gotten the patch out in time, but the real conversation should be about risk removal, not risk mitigation."

However, even in the best case, Microsoft may not be able to shave much more time off its response.

The software giant's delay in getting a patch to users was mainly due to quality control. The software giant had a patch candidate in less than 24 hours, but testing the patch against all its operating systems, as well as popular applications, took far longer. And, if the company had to make the choice all over again, it would still make the same decision, because breaking even a small number of systems' functionality is unacceptable, commented Kevin Kean, director of the Microsoft Security Response Center (MSRC).

"Let talk about the consequences of someone not having confidence in your patch," Kean said. "If Microsoft blows it, if people cannot trust our patches, they will not deploy them. It is critical that people have confidence in our patches, and that has been built into our ethos."

The software giant put more than 200 people on fixing the flaw and testing the patch, Kean said. The company's product teams vetted hundreds of applications to make sure that the patch caused no conflicts. As a result of the all-out development effort, Microsoft released the patch nine days after first learning about the vulnerability.

That may be the fastest the software giant has turned around a fix on a widespread software flaw. In a survey of security advisories released by Microsoft in the past three years, the Washington Post found that Microsoft has taken longer to fix vulnerabilities privately reported to the company, but has shortened its time to respond to public disclosures, which includes zero-day attacks. Microsoft took three months on average to fix issues privately disclosed to the company in 2003, a response time that shot up to 4.5 months in 2004 and 2005, according to the analysis. Yet, the company response to a publicly disclosed flaws has quickened, from 71 days in 2003 to 46 days in 2005.

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.