Microsoft Patches VML Vulnerability

Uncle Rummy writes, "Microsoft has quietly released an official patch for the zero-day VML vulnerability. The patch was publicly available yesterday, But Microsoft has just added it to the Security Bulletin Index." Eight days from time of first report to patch is pretty fast for Microsoft, and is almost two weeks ahead of their normal patch schedule. This security flaw was being aggressively exploited out in the wild.

Re:Firefox not vulnerable because VML not supporte

[Sephiroth9611]

Of course it didn't work in Firefox. MS is not interested in creating webpages that will work in other people's browsers.

Could this have something to do with...

[shoolz]

...the unofficial patch [heise-security.co.uk] that was release by independant security specialits? A bit of a black eye for MS, no?

Re:Not a bad turnaround

[LurkerXXX]

Umm, here's a big clue for you...

The virus/worm writers are the ones releasing the exploit into the wild the day after patch Tuesday.

That way they are more likely to have it expand for an entire month before MS patches it and messes up their fun.

Security researchers generally want things secure. Virus/Worm writers don't.

Probably not

[Sycraft-fu]

They release patches for critical, out in the wild, flaws as soon as they get them certified. You have to realise that they can't just release a patch right off, by their own policy and as a matter of practise. They have to go through a rather extensive certification procedure to make sure it won't cause computers to blow up. It's similar to patches you see for other OSes like Solaris. You'll hear of a bug and they'll be a patch out, but not one form Sun. That comes a bit later, after they've had time to test it.

You might not agree with the policy but that's how it is, and there are reasons for doing it that way. People already whine about patches breaking systems when at present it's an extremely rare occurrence (in all the cases I've encountered, said system was spywared and that was the problem). If they rushed patches out without testing and they ended up breaking things, it could easily get to a state where people refused to patch because they were more scared of the patch than the problem.

We are dealing with non-technical users here, remember. A patch can't include a page of instructions of things you need to check first, nor can it be assumed that if it causes a problem the user can troubleshoot and fix it. It pretty much has to work straight off, and has to do so on literally tens of millions of permutations of software and hardware configurations.

Personally I'd like to see a compromise where they'd release an unofficial, untested patch for power users as soon as they could and the full patch later after testing. However the likely problem would be the unofficial patch would get in the wild, people would tout it as the official MS patch, something would go wrong, and they'd get blamed anyhow.

Re:Not an issue for some

[hal2814]

From what I understand, being embedded into the OS is not a matter of shared libraries in this case. Some of the IE code is actaully running in kernel mode. The Konqueror broswer runs entirely in user mode from what I understand. Konqueror does call external libraries and those external libraries may enter kernel mode for a few well-defined tasks, but nothing on the level of what IE does if what I've read about IE's internals is true.

Re:XP SP2 problems

[Anonymous Coward]

Is everybody seeing the same trouble?

The only trouble I am seeing is why it has taken you so long to put SP2 on [some of] your machines.

It's NOT! 10/10/2006!

[antdude]

Its support will expire on October 10, 2006 according to Automatic Updates service. Also, see this Microsoft Web page [microsoft.com]. It's soon, but not over yet.

Quietly?

[kitman420]

Why is it that every time a patch is announced nowadays, it's announced as "X quietly releases a patch"? What? do they need fanfare or something?

Re:Not a bad turnaround

[LurkerXXX]

I don't think the patch tuesday was a microsoft idea. The released individually as they finished the review process for years. I think they got feedback from their large corporate customers saying it would be much easier for their admins to only have to certify and install patches in regular batches, rather than haphazardly as each became available. So I think it's microsoft's large customer's inane scheduling idea. Microsoft just accomodated what their largest customers requested. Not that I think it makes for the best securfity, but it's what the customers (the big noisy ones) asked for.