Feeds

MS Zero-day security bug was two years in the making

Fix only followed exploit

Using blade systems to cut costs and sharpen efficiencies

A flaw in Office Web Components which Microsoft fixed on Tuesday was first reported to the software giant over two years ago, it has emerged.

The time taken to release a patch has security vendors speculating that Redmond's security gnomes only got around to fixing the software flaw at all because hackers have begun exploiting it over recent weeks.

The arrival of the MS09-043 patch addressed a zero-day flaw that had become the fodder of drive-by download attacks from malicious web pages. The patch addressed four vulnerabilities in Office ActiveX control in total, including the zero-day flaw. Users previously had to rely on workarounds published by Microsoft in a July advisory.

The 0day security bug was discovered by researcher Peter Vreugdenhil and first reported to Microsoft in March 2007 via the TippingPoint's Zero Day initiative scheme, which pays researchers for security exploits.

TippingPoint uses this information to add signature detection against exploits based on the bug to its intrusion protection products. It also passes along the information to the relevant software developers, in this case Microsoft.

Responding to question on the long delay, ZDI manager Pedram Amini told heise Security, "they [Microsoft] kept finding the need for more time to ensure the issue was completely addressed".

TippingPoint is not one to rush vendors in general. Other security vendors, such as F-secure, remain puzzled about why the fix was so long in development.

A list of pending notifications from TippingPoint reveals that many vendors are yet to release fixes for "high" severity flaws a year after they were notified of a problem. Five such flaws are queued with Redmond, but Microsoft is in good company. CA, HP, IBM, Symantec, Mozilla and Adobe are also yet to release fixes for serious flaws they were informed about more than a year ago. ®

Bootnote

The buggy component in question here is a spreadsheet ActiveX control. The issue shouldn't be confused with Microsoft's patch for a buggy video ActiveX control, released in July. That update also addressed a zero-day bug but one Microsoft had known about for only a year, compared to two years in the latest case.

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.