Menu
Microsoft defends 100-day ANI patch process

Microsoft defends 100-day ANI patch process

Why the Windows animated cursor flaw wasn't patched for more than 100 days

Microsoft first learned of the animated cursor flaw in Windows in December 2006, more than 100 days before it released an emergency patch. The release marked just the third time in more than two years it has released an out-of-cycle security update.

The head of the company's security research lab defended the time spent investigating, developing and testing the fix. "Engineering a patch is a long, complex process," director of the Microsoft Security Response Center (MSRC), Mark Miller, said. "We look at surrounding areas of code for similar vulnerabilities and, from our internal investigation, address as many as we can find."

Microsoft was alerted to the ANI file bug on December 20 by Alexander Sotirov, a vulnerability researcher at Determina. By mid-March, when Microsoft skipped its usual second-Tuesday-of-the-month updates, the investigation had been completed and a patch created, Miller said. "But it was still undergoing testing," he said, explaining why the patch wasn't released then.

On March 28, McAfee notified the MSRC that it had spotted attacks exploiting the cursor flaw. Within five days, as attackers ramped up use of the exploit to include hundreds of malicious websites, Microsoft promised to release a patch a week ahead of its designated monthly release date, April 10.

Miller, as have other Microsoft security officials, said that the patch could be released early because it was already on the April schedule. "We had an opportunity, and by pulling in the window by a week, it was very doable," he said.

Miller rejected the idea that Microsoft rushed to release the fix only when exploits appeared and publicity mounted.

"The number of people working on it doesn't change [when exploits are active], but the 24/7, around-the-globe effort does," he said. "When McAfee notified us, we ramped up our software security incident response process [SSIRP] to track the attacks and see what level of activity there was."

Determina's Sotirov, who found the flaw while auditing other code in the same User32.dll that contained the ANI bug, refused to criticide Microsoft for the time it needed to create a fix.

"If you look at the average time it takes them, this vulnerability is not an exception," he said. "In fact, it's pretty standard."

By one metric, the numbers credit Microsoft. According to Symantec's analysis of patched vulnerabilities in the second half of 2006, Microsoft took an average of 21 days between the public disclosure of a vulnerability - code posted or mention made on a security mailing list such as Full Disclosure or Bugtraq - and patch release. The ANI vulnerability, obviously a closely guarded secret on the part of hackers, didn't "go public" until March 28, making for a window of only six days.

But the fact that Sotirov, not a Microsoft employee, found the ANI vulnerability speaks ill of the company's emphasis on security and its claims of code review. Several analysts and researchers, for instance, have noted the similarity between today's flaw and one patched in January 2005. That bug, fixed by the MS05-002 update, also involved animated cursors and was reported to Microsoft by researchers from eEye Digital Security 57 days before the patch was issued.

If, as Miller said, Microsoft used at least some time of the patch development process looking for similar vulnerabilities in the affected code, why wasn't the 2007 animated cursor flaw found in 2005? "We're doing an analysis of why we didn't find it then," Miller said.

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Mitel A/NZ Channel event Sydney (+23 photos)

IN PICTURES: Mitel A/NZ Channel event Sydney (+23 photos)

Unified communications company, Mitel, invited its top 30 partners in A/NZ to the Intercontinental Hotel in Sydney’s Double Bay. This is the first time the broader A/NZ Mitel channel community have been together since the company re-branding back in October 2014, post Aastra acquisition. ARN received an invite to join attendees for drinks and canapés on the hotel rooftop as Mitel and its partners toasted their recent success.

IN PICTURES: Mitel A/NZ Channel event Sydney (+23 photos)
IN PICTURES: ARN Emerging Leaders Think Tank, Sydney (+40 photos)

IN PICTURES: ARN Emerging Leaders Think Tank, Sydney (+40 photos)

Twenty-one industry leaders came together with ARN staff for an Emerging Leaders Think Tank, held at The Bottle Shop in Sydney​. The aim of the planning session was to develop a compelling program for high potential leaders in the Australian ICT industry.​ Over two hours of strong debate a core line of thought evolved which will form the basis of the Emerging Leaders Forum to be held on May 17 in Sydney. Photos by MARIA STEFINA.

IN PICTURES: ARN Emerging Leaders Think Tank, Sydney (+40 photos)

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments