Microsoft knew about IE flaw for months

Powered by SC Magazine
 

Told in September.

Microsoft knew about the critical flaw in Internet Explorer (IE) that was recently exploited by hackers to gain entry to the systems of Google and at least 20 other big name companies.

Redmond issued an out-of-cycle patch for the flaw yesterday, urging all IE users to apply the fix as soon as possible.

However, Microsoft security programme manager Jerry Bryant said in a blog posting yesterday: "When the attack discussed in Security Advisory 979352 was first brought to our attention on Jan 11, we quickly released an advisory for customers three days later.

"As part of that investigation, we also determined that the vulnerability was the same as a vulnerability responsibly reported to us and confirmed in early September."

The news will come as no surprise to many security watchers, although it highlights what some have described as an inadequate system of 'responsible disclosure'.

Last week, little-known Russian security firm Intevydis said that it will publish details of zero-day exploits in business software every day for the rest of January in protest at the private disclosure system which it believes is flawed.

Intevydis claimed that vendors usually sit on vulnerabilities that are disclosed in private, whereas they act faster if the disclosure is made public without prior knowledge.

"Our position on responsible disclosure policy has evolved, and now we do not support it because it is enforced by vendors and it allows vendors to exploit security researchers to do quality assurance work for free," the firm added in a blog posting.

Copyright ©v3.co.uk


Microsoft knew about IE flaw for months
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Optus expands 4G coverage
Oct 10, 2014
If you rely on an Optus phone for work you might be interested to know that there are now 200 ...
Microsoft Office is now free for some charities
Oct 10, 2014
Microsoft has announced that eligible Australian non-profit organisations and charities can now ...
Vodafone lights up 4G in Adelaide
Oct 9, 2014
Live and work in Adelaide? Vodafone has switched on its 4G network in the city and suburbs.
Next year tradies will be able to take payments using ingogo
Oct 3, 2014
Ingogo is going to provide a card payment service for Xero users.
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 328

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 136

Vote