Feeds

MS Zero-day security bug was two years in the making

Fix only followed exploit

SANS - Survey on application security programs

A flaw in Office Web Components which Microsoft fixed on Tuesday was first reported to the software giant over two years ago, it has emerged.

The time taken to release a patch has security vendors speculating that Redmond's security gnomes only got around to fixing the software flaw at all because hackers have begun exploiting it over recent weeks.

The arrival of the MS09-043 patch addressed a zero-day flaw that had become the fodder of drive-by download attacks from malicious web pages. The patch addressed four vulnerabilities in Office ActiveX control in total, including the zero-day flaw. Users previously had to rely on workarounds published by Microsoft in a July advisory.

The 0day security bug was discovered by researcher Peter Vreugdenhil and first reported to Microsoft in March 2007 via the TippingPoint's Zero Day initiative scheme, which pays researchers for security exploits.

TippingPoint uses this information to add signature detection against exploits based on the bug to its intrusion protection products. It also passes along the information to the relevant software developers, in this case Microsoft.

Responding to question on the long delay, ZDI manager Pedram Amini told heise Security, "they [Microsoft] kept finding the need for more time to ensure the issue was completely addressed".

TippingPoint is not one to rush vendors in general. Other security vendors, such as F-secure, remain puzzled about why the fix was so long in development.

A list of pending notifications from TippingPoint reveals that many vendors are yet to release fixes for "high" severity flaws a year after they were notified of a problem. Five such flaws are queued with Redmond, but Microsoft is in good company. CA, HP, IBM, Symantec, Mozilla and Adobe are also yet to release fixes for serious flaws they were informed about more than a year ago. ®

Bootnote

The buggy component in question here is a spreadsheet ActiveX control. The issue shouldn't be confused with Microsoft's patch for a buggy video ActiveX control, released in July. That update also addressed a zero-day bug but one Microsoft had known about for only a year, compared to two years in the latest case.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.