Microsoft criticised by SANS for releasing vulnerability details while the patch release is delayed

Speaking to Computer World, Swa Frantzen, an analyst at SANS Institute's Internet Storm Center, criticised Microsoft for issuing patches that fix the Windows versions of PowerPoint while announcing that patches for the same flaws in the Mac editions would not be released until June.

He claimed that revealing this information would allow a hacker to hijack computers before a patch is available. Microsoft revealed that Office for Mac 2004 and Office for Mac 2008 contain three unpatched vulnerabilities and the combination could be used by hackers to craft exploits targeting Macs.

An online poll on the ISC site showed that 47 per cent agreed Microsoft had been irresponsible in omitting patches for the Mac. Frantzen said: “Microsoft is the one big company screaming loudest of all over ‘responsible disclosure'.

“They want an unlimited amount of time to release their patches before those who found the problem are allowed to publish (but they can publish the second after Microsoft released the patch, all is fine for Microsoft, well, for their customer it's a bit of a different matter of course).

“Of course attackers couldn't care less about disclosure, and even some vulnerability researchers don't care for the credit line that Microsoft offers, nor the brand ‘irresponsible' it might earn them. Still a policy typically cuts both ways: you need to obey the rules yourself just as well as demand it from all others involved.”

See original article on scmagazineuk.com