For those who have been in the industry as long as I have, this out-of-cycle patch issued today by Microsoft will come as no surprise. Over the decades, Microsoft has demonstrated what can only be called massive ineptitude in dealing with critical security issues.
Microsoft only needs to look south to their acquaintances in Cupertino to see how computer security should really be handled. We have never seen Apple release an emergency out-of-cycle patch like this. Apple teams never blog about security issues, nor do they even have to present interim workarounds for severe vulnerabilities. Has anyone ever heard about Apple setting up anything that resembles Microsoft's SDL? Of course not; only companies that write insecure code need such a thing. I'll even go so far as to say that Macintosh products are so bulletproof that Apple only needs to release security patches on an irregular and haphazard basis.
I sincerely hope that Microsoft can learn from Apple the correct approach to securing software for the 21st century: not only to save the company, but also to protect each and every one of its customers.
Microsoft has rushed out and emergency patch for all supported versions of Windows to cover a gaping — and under attack — security flaw in the way shortcuts are displayed by the operating system.
The out-of-band update, rated “critical,” comes less than 20 days after the discovery of a sophisticated malware attack that combined the Windows zero-day flaw with security problems in SCADA systems and used stolen signed drivers to bypass security software.
Copycat attackers also added exploits for the Windows vulnerability into malware families, putting pressure on Redmond to release today’s emergency fix.
From Microsoft’s MS10-046 bulletin:
The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
The flaw affects all currently supported versions of Windows XP, Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2.
More to come…
