Microsoft "silently" patches vulnerabilities, leaves admins in the dark
Summary: Security firm Core Security Technologies has pulled up Microsoft on its practice of silently patching as it doesn't give system administrators the information they require to keep their systems safe.
Security firm Core Security Technologies has pulled up Microsoft on its practice of silently patching as it doesn't give system administrators the information they require to keep their systems safe.
The two patches in question are MS10-024 and MS10-028.
These two patches contains a total of three "silent" fixes, fixes for bugs that Microsoft has uncovered internally. Microsoft's policy on these fixes is that it doesn't disclose them as part of the monthly disclosure list. But in this case, the practice means that the seriousness of the update is underestimated by Microsoft.
Take MS10-014. The disclosure claims that this update patches a DoS (Denial of Service) vulnerability. However, Core Security Technologies uncovered two, more serious bug fixes.
While researching the fixes issued by Microsoft in Microsoft's Security Bulletin MS10-024 published April 13, 2010 Nicolás Economou discovered two vulnerabilities in Windows SMTP Service and Microsoft Exchange . These vulnerabilities were fixed by the patches referenced in MS10-024 but were not disclosed in the vendor's security bulletin and did not have an unique vulnerability identifier assigned to them. As a result, the guidance and the assessment of risk derived from reading the vendor's security bulletin may overlook or missrepresent actual threat scenarios....
An attacker may leverage the two previouly undisclosed vulnerabilities fixed by MS10-014 to spoof responses to any DNS query sent by the Windows SMTP service trivially. DNS response spoofing and cache poisoning attacks are well known to have a variety of security implications with impact beyond just Denial of Service and Information Disclosure as originally stated in MS10-024.
As a result the importance of deploying MS10-024 patches may be miss-represented in the vendor's security bulletin. Organizations using vulnerable packages should consider re-assessing patch deployment priorities in view of the additional information provided in this advisory.
Now, we've known for some time that Microsoft doesn't disclose vulnerabilities it discovers, but this is the first time that we've seen first-hand how not disclosing all the vulnerabilities fixed by patches can skew the seriousness of the patch itself. In the example above, MS10-024 is actually a far more important patch that the advisory issued by Microsoft would lead users to believe it is.
Microsoft - Do the right thing and start listing ALL vulnerabilities fixed by a patch!
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
RE: Microsoft
RE: Microsoft "silently" patches vulnerabilities, leaves admins in the dark
Actually it's crucial to document the fixes being applied, with that, on the off chance that anything should go wrong applying these updates, system admins have the KB documentation to fall back on, without this documentation, admins are left in the dark as to what happened and where the problem occurred.
RE: Microsoft "silently" patches vulnerabilities, leaves admins in the dark
Fixing them wasn't bad. Hiding it from administrators so they didn't know..
RE: Microsoft "silently" patches vulnerabilities, leaves admins in the dark
@GoodThings2Life
Did you check the accuracy of the report first?
I'm not saying the report is wrong, mind you.
What really ticks me off is web journalism that seems to have forgotten all the basic lessons from print journalism, one of which is, check your facts before publishing.
Do you have any valid reasons to question the accuracy of the report?
RE: Microsoft "silently" patches vulnerabilities, leaves admins in the dark
If you had read what I actually wrote, I was not in any way disputing the veracity of the report itself.
My concern is the way that Web journalism makes no attempt at checking the validity of what it reports on. If this had been, say, a radio report, you would almosr certainly have heard something to the effect of "We attempted to reach Microsoft for their comments, but could not reach them", or "We reached Microsoft, but they refused to comment".
The fact that there is no such statement on this blog posting is just another sad comment on the poor state of web journalism.
RE: But you ARE attacking the accuracy of the report.
RE:Do you have any valid reasons to question the accuracy of the report?
I'm with easson
Right because it's not like Microsoft might be biased in favor of Microsoft
Well, Microsoft DID release patches but no info on what exactly was patched
Besides, Microsoft??????s policy on these fixes is that it doesn??????t disclose them as part of the monthly disclosure list. With a policy like that in place I wish you good luck when trying to reach Microsoft for comment.
I guess you don't live in a country where unbiased journalism is valued
Once again, look atw hat I wrote. I was not questioning the varacity of the report. I was questioning the journalistic integrity of the blogger. Maybe you live in a country (US???) where integrity in reporting is now so foreign a concept that you are shocked by the suggestion.
@easson
If it [i]does[/i], I'd just like to ask you; what country [i]is[/i] unbiased journalism valued in?
RE: Microsoft "silently" patches vulnerabilities, leaves admins in the dark
This is an opinion piece on the findings of a report issued by another company - if Microsoft wanted to comment on it, they could issue a press release in response to the report but not to the authors opinion on the report.
Checking the accuracy of the report with Microsoft first?
Are you serious? Microsoft doesn??????t want this information made public. It will prove their software is no better than other software, and cast doubts on the metric that is used to gauge software quality these days; the amount of patches that are applied. Microsoft is actively putting its public image, ahead of public interests. The spin doctors at Microsoft would say it is simply not true, and start a F.U.D campaign against the company that reported the finding.
Calling George Ou
Really, you wouldn't know that from the superficial vulnerability analysis we've been subjected to here on ZDNet by particular authors.
Advisories should, of course, disclose all information. In the *nix world we use such information to determine what patches are required and how urgently.
It's probably not as important for the MSCE, who's skill-set relies on frantic clicking & rebooting, but I'm sure there is at least a couple of windows servers looked after by professionals;-)
Only with Microsoft would patching extra vulnerabilities be viewed as...