Microsoft Under Fire for Patch Delay

The patch Microsoft released on Tuesday for one of the most severe flaws yet discovered in Windows has the company under renewed scrutiny about the length of time it takes to fix security problems.

The flaw involves Microsoft's Abstract Syntax Notation One (ASN.1), a data standard used by applications and devices for allowing normalization and understanding of data across platforms. The flaw is present in Windows NT, Windows 2000, Windows XP and Windows Server 2003 and can allow remote code execution.

While Microsoft has greatly improved the quality of its software from a security perspective over the last two years, security experts view the current problem as extremely severe. Even well-secured networks are vulnerable if the patch isn't in place on its machines, and the vulnerability is ripe for automated remote exploitation.

But the bigger complaint in this case involves Microsoft's apparently sluggish response. The firm that discovered the flaw, eEye Digital Security, revealed on Tuesday that it first alerted Microsoft about the problem in July, more than six months before Microsoft managed to produce a patch. "We contacted Microsoft about these vulnerabilities 200 days ago, which is insane," eEye co-founder Marc Maiffret told Reuters.

Microsoft officials countered that the pervasiveness of the vulnerability in its software required extra time and investigation to do the fix properly.

The issue adds to a controversy already brewing about Microsoft's two-month delay in getting a fix out for a URL spoofing problem in Internet Explorer. Microsoft posted a workaround in December, but didn't produce a patch until last week.

The combination of the ASN.1 delay and the Internet spoofing delay could resuscitate a debate that Microsoft had largely put to rest about whether it was more responsible for security researchers to immediately publicize flaws they find or work secretly with vendors to fix the flaws before announcing them.

Maiffret's public venting about Microsoft's sluggishness could be a sign that the most aggressive and prolific bug-hunting security firms are losing patience with Microsoft's process.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Microsoft Drops 'Solorigate' for 'Nobelium' in Ongoing SolarWinds Attack Investigations

    Microsoft this week described "three new pieces" of malware that were used in the SolarWinds Orion espionage attacks dubbed "Solorigate," although Microsoft security researches are now calling it "Nobelium."

  • Microsoft Universal Print Service Commercially Released

    Microsoft announced on Tuesday that its Universal Print service is now commercially released at the "general availability" stage worldwide.

  • Restoring a Backup to Dissimilar Hardware: 3 Things To Watch Out For

    Getting a new desktop looking and feeling like the old one used to take a long time, but modern backup applications have greatly streamlined the process. Still, there are a few things to keep in mind to avoid potential issues.

  • Black Box

    Microsoft Releases Windows Server 2022 Preview

    Microsoft announced during its Ignite event that Window Server 2022 is currently availability at the preview stage.

comments powered by Disqus