Microsoft knew about IE flaw for months

Powered by SC Magazine
 

Told in September.

Microsoft knew about the critical flaw in Internet Explorer (IE) that was recently exploited by hackers to gain entry to the systems of Google and at least 20 other big name companies.

Redmond issued an out-of-cycle patch for the flaw yesterday, urging all IE users to apply the fix as soon as possible.

However, Microsoft security programme manager Jerry Bryant said in a blog posting yesterday: "When the attack discussed in Security Advisory 979352 was first brought to our attention on Jan 11, we quickly released an advisory for customers three days later.

"As part of that investigation, we also determined that the vulnerability was the same as a vulnerability responsibly reported to us and confirmed in early September."

The news will come as no surprise to many security watchers, although it highlights what some have described as an inadequate system of 'responsible disclosure'.

Last week, little-known Russian security firm Intevydis said that it will publish details of zero-day exploits in business software every day for the rest of January in protest at the private disclosure system which it believes is flawed.

Intevydis claimed that vendors usually sit on vulnerabilities that are disclosed in private, whereas they act faster if the disclosure is made public without prior knowledge.

"Our position on responsible disclosure policy has evolved, and now we do not support it because it is enforced by vendors and it allows vendors to exploit security researchers to do quality assurance work for free," the firm added in a blog posting.

Copyright ©v3.co.uk


Microsoft knew about IE flaw for months
 
 
 
Top Stories
Don’t mention digital disruption to David Whiteing
Buzzwords don’t curry favour with CBA's new CIO - it’s all just innovation to him.
 
Content, cost & constant innovation: How Foxtel plans to take on Netflix
Nell Payne inhabits the “brave new world of blue strings and networking”. Just don't ask her to put a TV screen on your microwave.
 
Westpac fires starting pistol on core banking upgrade
St George readies itself for move to Celeriti.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Microsoft launches Office for Android preview
May 22, 2015
Microsoft has launched a preview of Office for Android smartphones. Pre-release versions of ...
Microsoft is working on an iOS email chat feature called Flow
May 22, 2015
Microsoft is working on a new chat app, but at the moment we know more about what we DON'T know, ...
Windows 10 free upgrade: Microsoft details who gets what
May 22, 2015
Microsoft was meant to be streamlining its OS with Windows 10, so why is upgrading so confusing? ...
Windows 10 has an edition to suit everyone's needs
May 15, 2015
Microsoft unveils a mind-melting six editions of Windows 10 ahead of its Winter 2015 launch. ...
Firefox 38 FINAL released, debuts new tab-based preferences
May 13, 2015
Mozilla has unveiled the latest version of Firefox 38.0 FINAL for desktop, with Firefox for ...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  43%
 
No
  57%
TOTAL VOTES: 565

Vote