Microsoft defends 100-day ANI patch process

Why the Windows animated cursor flaw wasn't patched for more than 100 days

Microsoft first learned of the animated cursor flaw in Windows in December 2006, more than 100 days before it released an emergency patch. The release marked just the third time in more than two years it has released an out-of-cycle security update.

The head of the company's security research lab defended the time spent investigating, developing and testing the fix. "Engineering a patch is a long, complex process," director of the Microsoft Security Response Center (MSRC), Mark Miller, said. "We look at surrounding areas of code for similar vulnerabilities and, from our internal investigation, address as many as we can find."

Microsoft was alerted to the ANI file bug on December 20 by Alexander Sotirov, a vulnerability researcher at Determina. By mid-March, when Microsoft skipped its usual second-Tuesday-of-the-month updates, the investigation had been completed and a patch created, Miller said. "But it was still undergoing testing," he said, explaining why the patch wasn't released then.

On March 28, McAfee notified the MSRC that it had spotted attacks exploiting the cursor flaw. Within five days, as attackers ramped up use of the exploit to include hundreds of malicious websites, Microsoft promised to release a patch a week ahead of its designated monthly release date, April 10.

Miller, as have other Microsoft security officials, said that the patch could be released early because it was already on the April schedule. "We had an opportunity, and by pulling in the window by a week, it was very doable," he said.

Miller rejected the idea that Microsoft rushed to release the fix only when exploits appeared and publicity mounted.

"The number of people working on it doesn't change [when exploits are active], but the 24/7, around-the-globe effort does," he said. "When McAfee notified us, we ramped up our software security incident response process [SSIRP] to track the attacks and see what level of activity there was."

Determina's Sotirov, who found the flaw while auditing other code in the same User32.dll that contained the ANI bug, refused to criticide Microsoft for the time it needed to create a fix.

"If you look at the average time it takes them, this vulnerability is not an exception," he said. "In fact, it's pretty standard."

By one metric, the numbers credit Microsoft. According to Symantec's analysis of patched vulnerabilities in the second half of 2006, Microsoft took an average of 21 days between the public disclosure of a vulnerability - code posted or mention made on a security mailing list such as Full Disclosure or Bugtraq - and patch release. The ANI vulnerability, obviously a closely guarded secret on the part of hackers, didn't "go public" until March 28, making for a window of only six days.

But the fact that Sotirov, not a Microsoft employee, found the ANI vulnerability speaks ill of the company's emphasis on security and its claims of code review. Several analysts and researchers, for instance, have noted the similarity between today's flaw and one patched in January 2005. That bug, fixed by the MS05-002 update, also involved animated cursors and was reported to Microsoft by researchers from eEye Digital Security 57 days before the patch was issued.

If, as Miller said, Microsoft used at least some time of the patch development process looking for similar vulnerabilities in the affected code, why wasn't the 2007 animated cursor flaw found in 2005? "We're doing an analysis of why we didn't find it then," Miller said.

More about: eEye Digital Security, McAfee, Microsoft, Symantec
Comments are now closed.
Related Whitepapers
Latest Stories
Community Comments
ARN Directory | Distributors relevant to this article
Anyware Corporation , Aquion , Bluechip Infotech , Com1 International , Dicker Data , Express Data , ICT Distribution , Impact Systems Technology , Ingram Micro Australia , Leader Computers , Lynx Technologies , Multimedia Technology , NewLease , Synnex Australia , Topstar Computer International , Westcon Group , Wholesale IT , XiT Distribution
ARN Directory | Vendors relevant to this article
Symantec
Get exclusive access to ARN's news, research and invitation only events.
ARN Distributor Directory
ARN Vendor Directory
Microsites

iAsset is a channel management ecosystem that automates all major aspects of the entire sales,marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

 
Computerworld
CIO
Techworld
CMO

Latest News

04:32PM
Pacnet collaborates with China Telecom
04:21PM
4K brings flexibility to digital photography: Panasonic
03:22PM
MAXON partners with Side Effects Software
02:34PM
JB Hi-Fi chief executive Terry Smart to step down
More News
24 Apr
The China Healthcare ICT Conference 2014
05 May
CeBIT Australia 2014
06 May
Oracle Day 2014 - Across 2 Cities
06 May
Oracle Day 2014 - Across 2 Cities
View all events