MS Zero-day security bug was two years in the making
Fix only followed exploit
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
A flaw in Office Web Components which Microsoft fixed on Tuesday was first reported to the software giant over two years ago, it has emerged.
The time taken to release a patch has security vendors speculating that Redmond's security gnomes only got around to fixing the software flaw at all because hackers have begun exploiting it over recent weeks.
The arrival of the MS09-043 patch addressed a zero-day flaw that had become the fodder of drive-by download attacks from malicious web pages. The patch addressed four vulnerabilities in Office ActiveX control in total, including the zero-day flaw. Users previously had to rely on workarounds published by Microsoft in a July advisory.
The 0day security bug was discovered by researcher Peter Vreugdenhil and first reported to Microsoft in March 2007 via the TippingPoint's Zero Day initiative scheme, which pays researchers for security exploits.
TippingPoint uses this information to add signature detection against exploits based on the bug to its intrusion protection products. It also passes along the information to the relevant software developers, in this case Microsoft.
Responding to question on the long delay, ZDI manager Pedram Amini told heise Security, "they [Microsoft] kept finding the need for more time to ensure the issue was completely addressed".
TippingPoint is not one to rush vendors in general. Other security vendors, such as F-secure, remain puzzled about why the fix was so long in development.
A list of pending notifications from TippingPoint reveals that many vendors are yet to release fixes for "high" severity flaws a year after they were notified of a problem. Five such flaws are queued with Redmond, but Microsoft is in good company. CA, HP, IBM, Symantec, Mozilla and Adobe are also yet to release fixes for serious flaws they were informed about more than a year ago. ®
Bootnote
The buggy component in question here is a spreadsheet ActiveX control. The issue shouldn't be confused with Microsoft's patch for a buggy video ActiveX control, released in July. That update also addressed a zero-day bug but one Microsoft had known about for only a year, compared to two years in the latest case.
COMMENTS
Zero Day Bug how about 730 day bug
http://www.theregister.co.uk/Design/graphics/icons/comment/flame_32.png
There really should be some guidelines in place that limit the amount of time it takes to fix these bugs. The more time they are out there being exposed the more time the hacker/cracker or anyone else for that matter has to exploit millions of computers. With all the cyber attacks lately you really would think IT security would notch this up as a main priority.
For Flying Pink Elephants....
"Meanwhile, you could just ignore all that. Just I'd advise not plotting world domination using your PC or networked devices.
Cheerio." .... By SoltanGris Posted Sunday 16th August 2009 03:19 GMT
Hello. I'd like to advise that nowadays plotting world domination without the use of the humble ubiquitous PC or networked devices is to Guarantee and Invite Failure and mounting future problems which will be targeted for resolution/binary blasting with PCs and networked devices.
This is what is possible today, and it was Registered two days ago too ...... "If you are in Denial and Disbelief of SMARTer Third Parties building with AI ProgramMING an Altogether Fundamentally Different New World Order with Cloud Control for Virtually and Vitally Important Operating Systems, do such Elemental First Party Failings Present and Guarantee Unconventional and Irregular Forces, Perfect Future Intelligence Stealth for Great Game TakeOvers and Big Picture MakeOvers." ..... but failed ITs Sensitive Subjective Peer Review Test for Comment Publication on El Reg, but IT is Vital Virile Viral Information for Any and All Quantum Communications Control Systems for the Virtualised Environment and ITs Cloudy GUI Power Distribution Layers/Levels/Desktops...... All Singing All Dancing Laptops.
And One Virtual Machine to Control and Power them All? Which would be a Fool Question and QuITe Preposterous Impossible Notion to Most Everybody but merely a Noble Nobel Work in Progress to the Next Higher Levels of Confusion and CompleXXXX Simplicity for a Few Master Pilots ......... Per Ardua ad MetaAstra.
Given the Massive Server Store of Public Flight Information on such Matters, deposited freely with the Register, it would not be something which can be denied and/or disputed.
Re: @Zero-day?
I'm mr.K, if the vendor and the security community (at least the organization who reported the bug) knew about it for two years, then it is most definitely *not* a zero-day vulnerability, but more like a 730-day vulnerability (not accounting for a leap-year within those two).
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
