Microsoft to Patch WMF Exploit Early

Chran writes "Microsoft has just announced that they will release a security update for the .WMF-exploit today at 2pm ET, instead of Tuesday, as originally planned. Microsoft writes: "Microsoft originally planned to release the update on Tuesday, January 10, 2006 as part of its regular monthly release of security bulletins, once testing for quality and application compatibility was complete. However, testing has been completed earlier than anticipated and the update is ready for release. In addition, Microsoft is releasing the update early in response to strong customer sentiment that the release should be made available as soon as possible."

Comments

Reactive vs Proactive

[biocute]

Microsoft is releasing the update early in response to strong customer sentiment that the release should be made available as soon as possible.

It would have been nicer if they make patches available as soon as possible with or without strong customer sentiment.

Re:Reactive vs Proactive

[targo]

It would have been nicer if they make patches available as soon as possible with or without strong customer sentiment.

This doesn't make any sense. All patch release dates are a function of:
1) impact of the problem
2) complexity of required testing
The idea being that the patch shouldn't cause more harm than the original flaw.
If the impact is huge, testing of more obscure cases can be deferred somewhat. If the impact is small, more time can be taken.
So if there hadn't been any customer sentiment (i.e. no one cared), it would make no sense to rush the patch and risk breaking something.

Re:Reactive vs Proactive

[grcumb]

"If the impact is huge, testing of more obscure cases can be deferred somewhat. If the impact is small, more time can be taken."

I'm with you so far....

"So if there hadn't been any customer sentiment (i.e. no one cared), it would make no sense to rush the patch and risk breaking something."

Err, that's a non-sequitur. Whether customers care or not has nothing to do with the cost/benefit analysis that decides the timing and scope of an initial patch. A software company should never rely on its customers to perform risk analysis. If it's serious (and the WMF flaw is egregiously so), then you find a way to protect your customers as quickly and effectively as you can. In some cases - though certainly not all - you can even accept shortcomings in the patch itself if significantly reduces the risk.

The third-party patch, for example, causes issues with the Windows printing subsystem. People voiced suspicions that this might be the case right from the start, though confirmation only came through earlier today. To my mind, that was an acceptable risk. A server that can't perform some print tasks and won't show pretty preview icons is worth a heck of a lot more to me than one that's 0wned by some random script kiddy.

And before some astroturfing twit spouts the simplistic, binary logic of 'MS is damned if they do and damned if they don't', I'd like to say from experience that deciding the timing of a security patch is a terribly difficult process. It requires the right amount of analytical skill, deep technical expertise, a healthy dose of horse sense and exactly the right measure of patience. Too much or too little of any of these can result in exactly the wrong kind of response.

Patching is not about being a nice guy. It's not about what your customers think of you. There should be no marketing or sales angle in the creation or timing of a security patch. You determine the scope and severity of the threat, be as thorough as you can reasonably hope to be (and that's never as thorough as you'd like), and deliver it as soon as you reasonably can.

I'm in complete agreement with this handler's diary from isc.sans.org concerning Microsoft's announcement that they would issue the patch at the regularly scheduled time. Given the severity of the flaw, it's unconscionable that they should leave their customers exposed for so long. The fact that they only decided to release the patch out of cycle in response to their users demonstrates that they're far more worried about their image than they are about their software. This does not bode well at all for them. Or for their customers, for that matter.

Splendid...

[Hymer]

...only 10 days too late...
---
tis is not a FP

8 Days to patch

[badriram]

Maybe it is just me, but 8 days for a tested patch does not seem that long. However it was a 0 day which made this exploit special.

Re:8 Days to patch

[Anonymous Coward]

ProTip : If a third party can patch it faster than you, without access to the original source code - you suck.

Re:8 Days to patch

[croddy]

1. Release patch 8 days late
2. Describe it as an "early" release
3. ???
4. Profit!!!

Thank you, Big Brother

[Gadren]

"It appeared that there had even been demonstrations to thank Big Brother for raising the chocolate ration to twenty grammes a week. And only yesterday, he reflected, it had been announced that the ration was to be reduced to twenty grammes a week. "

I know, I know...

[Eberlin]

Damned if they send out patches as they're made (too many, too confusing) and damned if they wait 'til Patch Tuesday (negligent, inconsiderate).

We can't have it both ways, and neither should they. I say send out patches as they're made and let the sysadmins be responsible for whether they can keep up or not. It may be difficult to admin many machines that have to be patched but I'd rather have fixes available ASAP and put the burden on IT to apply them.

Yeah, there are patches that will break stuff and ample testing should be done anyway...but does rolling them all into a Patch Tuesday really change that fact? Probably not.

With this sentiment, we can put more pressure on Patch Tuesday for what it really is -- a Trustworthy Computing PR stunt in which the number of fixes and vulnerabilities seems to be lower (since we're only patching once a month...maybe).

All that said, kudos to MS for reacting...but unkudos for taking this long...and major unkudos for being naive about the WMF design to begin with.

Re:and millions of /.'ers groan...

[ergo98]

Well the funny thing is that this exploit only affects Internet Explorer as well. So basically what they are saying is

They aren't "saying" anything. The Windows Update web app, as a requirement of the fact that it uses ActiveX, requires Internet Explorer. Nonetheless, not only is the patch rolling out right now via auto-updates, you can also download it directly.

In any case, even though I use Firefox and Opera for my day to day browsing, I really don't feel that threatened firing up Internet Explore for the purpose of connecting to Microsoft.

Early release to catch out the hackers

[briqui]

Telling everyone that they are going to wait till Tuesday to patch the problem, then releasing a patch 5 days earlier might actually be quite a neat trick.

I'm sure a lot of people out there who were planning to taking advantage of this problem have been thinking that they have till Tuesday to write a really good exploit, and therefore not hurrying too much.

Now Microsoft come along and patch it early.

I don't know about anyone else but I was expecting Monday do be a day from hell...

3rd party did not patch vulnerability

[badriram]

They just blocked the execution of the vulnerable function. This to me a mitigation method not a patch. Think of it as, there is a vulnerability in mod_rewrite within apache, and a third party "patch", just disables it, to secure apache.

"testing ... completed earlier than anticipated"

[antispam_ben]

Translation: "Our ass needed covering even earlier than anticipated."

Re:Sadly no

[Tony Hoyle]

No, they're just companies that can't spend half a million dollars upgrading hardware and software just to run the latest whizz-bang eye candy from microsoft, when what they have works just fine.

Over 40% of our customers are NT4 shops. Some of them are *big*.