Microsoft has issued an out-of-cycle patch for the IE flaw
Microsoft knew about IE flaw for months
/v3-uk/news/1962386/microsoft-ie-flaw-months
22 Jan 2010, Phil Muncaster , V3
Microsoft knew about the critical flaw in Internet Explorer (IE) that was recently exploited by hackers to gain entry to the systems of Google and at least 20 other big name companies.
Redmond issued an out-of-cycle patch for the flaw yesterday, urging all IE users to apply the fix as soon as possible.
However, Microsoft security programme manager Jerry Bryant said in a blog posting yesterday: "When the attack discussed in Security Advisory 979352 was first brought to our attention on Jan 11, we quickly released an advisory for customers three days later.
"As part of that investigation, we also determined that the vulnerability was the same as a vulnerability responsibly reported to us and confirmed in early September."
The news will come as no surprise to many security watchers, although it highlights what some have described as an inadequate system of 'responsible disclosure'.
Last week, little-known Russian security firm Intevydis said that it will publish details of zero-day exploits in business software every day for the rest of January in protest at the private disclosure system which it believes is flawed.
Intevydis claimed that vendors usually sit on vulnerabilities that are disclosed in private, whereas they act faster if the disclosure is made public without prior knowledge.
"Our position on responsible disclosure policy has evolved, and now we do not support it because it is enforced by vendors and it allows vendors to exploit security researchers to do quality assurance work for free," the firm added in a blog posting.
© Incisive Media Investments Limited 2010, Published by Incisive Financial Publishing Limited, Haymarket House, 28-29 Haymarket, London SW1Y 4RX, are companies registered in England and Wales with company registration numbers 04252091 & 04252093
Do you agree?
Shocking apathy and sluggishness
"Microsoft knew about IE flaw for months
Redmond admits it was notified about the vulnerability in September"
Unforgivable
Posted by Paul, 30 Jan 2010
Microsoft IE8, Firefox or Google Chrome
The recent announcements made by the French and German governments warning users to find an alternative to Microsoft's Internet Explorer 6 (IE6) amidst apparent security risks associated with the browser, could prove fruitful for UK IT-aware businesses. Not only will the warning provoke a greater level of conscientious thought for IT security, but it could also act as a catalyst for businesses wishing to move their technology on and maximise on services optimised for this technology.
For most businesses, protecting IT security is of paramount importance, especially for those organisations working in a virtualised environment. In light of the news surrounding the security risks associated with IE6, could this be the time to get ahead of the game and look to upgrade to Microsoft Internet Explorer 8, or other browsers such as Firefox or Google Chrome, as suggested?
A move like this is simple and allows businesses to not only to reap the benefits of the new technology and prevent a potential security issue, but also receive additional functions when selecting tailor-made business applications designed to work specifically with the most up-to-date technology and can provide the advantages of this to the business.
Yours Sincerely,
Nick Thompson
Managing Director
DCSL Software
www.dcsl.com
Posted by Nick Thompson, 22 Jan 2010