Microsoft knew about IE flaw for months

Powered by SC Magazine
 

Told in September.

Microsoft knew about the critical flaw in Internet Explorer (IE) that was recently exploited by hackers to gain entry to the systems of Google and at least 20 other big name companies.

Redmond issued an out-of-cycle patch for the flaw yesterday, urging all IE users to apply the fix as soon as possible.

However, Microsoft security programme manager Jerry Bryant said in a blog posting yesterday: "When the attack discussed in Security Advisory 979352 was first brought to our attention on Jan 11, we quickly released an advisory for customers three days later.

"As part of that investigation, we also determined that the vulnerability was the same as a vulnerability responsibly reported to us and confirmed in early September."

The news will come as no surprise to many security watchers, although it highlights what some have described as an inadequate system of 'responsible disclosure'.

Last week, little-known Russian security firm Intevydis said that it will publish details of zero-day exploits in business software every day for the rest of January in protest at the private disclosure system which it believes is flawed.

Intevydis claimed that vendors usually sit on vulnerabilities that are disclosed in private, whereas they act faster if the disclosure is made public without prior knowledge.

"Our position on responsible disclosure policy has evolved, and now we do not support it because it is enforced by vendors and it allows vendors to exploit security researchers to do quality assurance work for free," the firm added in a blog posting.

Copyright ©v3.co.uk


Microsoft knew about IE flaw for months
 
 
 
Top Stories
Qld Transport to replace core registration system
State's biggest citizen info repository set for overhaul.
 
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
How technology will unify Toll
The systems headache formed through 15 years of acquisitions.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
More 4G from Optus in Darwin
Nov 21, 2014
Click to see where Optus has expanded coverage to the suburbs near Darwin.
Optus steps up regional 4G coverage
Nov 20, 2014
Once 700Mhz services are working, Optus claims regional users will have a "faster and more ...
This Huawei 4G phone costs $99
Nov 12, 2014
The $99 Huawei Ascend Y550, available through Vodafone, enters the budget market as one of the ...
4G smartphones: Microsoft's Lumia 830
Nov 7, 2014
Microsoft has announced its flagship Windows Phone, the Nokia Lumia 830 4G, will be available in ...
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 844

Vote