Microsoft defends 100-day ANI patch process

Why the Windows animated cursor flaw wasn't patched for more than 100 days

Microsoft first learned of the animated cursor flaw in Windows in December 2006, more than 100 days before it released an emergency patch. The release marked just the third time in more than two years it has released an out-of-cycle security update.

The head of the company's security research lab defended the time spent investigating, developing and testing the fix. "Engineering a patch is a long, complex process," director of the Microsoft Security Response Center (MSRC), Mark Miller, said. "We look at surrounding areas of code for similar vulnerabilities and, from our internal investigation, address as many as we can find."

Microsoft was alerted to the ANI file bug on December 20 by Alexander Sotirov, a vulnerability researcher at Determina. By mid-March, when Microsoft skipped its usual second-Tuesday-of-the-month updates, the investigation had been completed and a patch created, Miller said. "But it was still undergoing testing," he said, explaining why the patch wasn't released then.

On March 28, McAfee notified the MSRC that it had spotted attacks exploiting the cursor flaw. Within five days, as attackers ramped up use of the exploit to include hundreds of malicious websites, Microsoft promised to release a patch a week ahead of its designated monthly release date, April 10.

Miller, as have other Microsoft security officials, said that the patch could be released early because it was already on the April schedule. "We had an opportunity, and by pulling in the window by a week, it was very doable," he said.

Miller rejected the idea that Microsoft rushed to release the fix only when exploits appeared and publicity mounted.

"The number of people working on it doesn't change [when exploits are active], but the 24/7, around-the-globe effort does," he said. "When McAfee notified us, we ramped up our software security incident response process [SSIRP] to track the attacks and see what level of activity there was."

Determina's Sotirov, who found the flaw while auditing other code in the same User32.dll that contained the ANI bug, refused to criticide Microsoft for the time it needed to create a fix.

"If you look at the average time it takes them, this vulnerability is not an exception," he said. "In fact, it's pretty standard."

By one metric, the numbers credit Microsoft. According to Symantec's analysis of patched vulnerabilities in the second half of 2006, Microsoft took an average of 21 days between the public disclosure of a vulnerability - code posted or mention made on a security mailing list such as Full Disclosure or Bugtraq - and patch release. The ANI vulnerability, obviously a closely guarded secret on the part of hackers, didn't "go public" until March 28, making for a window of only six days.

But the fact that Sotirov, not a Microsoft employee, found the ANI vulnerability speaks ill of the company's emphasis on security and its claims of code review. Several analysts and researchers, for instance, have noted the similarity between today's flaw and one patched in January 2005. That bug, fixed by the MS05-002 update, also involved animated cursors and was reported to Microsoft by researchers from eEye Digital Security 57 days before the patch was issued.

If, as Miller said, Microsoft used at least some time of the patch development process looking for similar vulnerabilities in the affected code, why wasn't the 2007 animated cursor flaw found in 2005? "We're doing an analysis of why we didn't find it then," Miller said.

2015 ARN ICT Industry Awards: NOMINATE NOW!!!: Nominations for the 2015 ARN ICT Industry Awards are now open. Once again, it is time to NOMINATE NOW!!!

Join the ARN newsletter!

Error: Please check your email address.

More about eEye Digital SecurityMcAfee AustraliaMicrosoftSymantec

ARN Directory | Distributors relevant to this article

ARN Directory | Vendors relevant to this article

Show Comments
 
Computerworld
CIO
Techworld
CMO

Latest News

May 29
Exclusive Group secures new investment to support continued growth strategy
May 29
Avaya awards its top Asia-Pacific channel partners
May 29
A/NZ Shoppers deserting retailers due to online performance issues: Rackspace
May 29
Fujitsu World Tour 2015: A focus on the healthy human side of IoT (+8 photos)
More News
04 Jun
Websense Data Theft Prevention Breakfast - Melbourne
04 Jun
IM Experience, Sydney
09 Jun
Ascom Nurse Call product launch
10 Jun
D-Link IP Surveillance Training and Certification
View all events