http://news.com.com/Viruses+exploit+Microsoft+patch+cycle/2100-7349_3-5446624.html By Munir Kotadia Special to CNET News.com November 10, 2004 The creators of the latest MyDoom variant, which exploits a recently discovered iFrame vulnerability in Internet Explorer, may have timed the release of the viruses to throw Microsoft's monthly patch cycle into disarray, security experts say. In its latest monthly update on Tuesday, Microsoft was not able to fix a serious vulnerability in the Internet Explorer browser because the flaw was discovered only a few days before the company's regular update was due. The two variants of the MyDoom virus were released earlier this week, leaving the software giant without any option but to ignore the problem--for now. Sean Richmond, senior technology consultant at Sophos Australia, told ZDNet Australia that it would have been impossible for Microsoft to create and test a reliable patch in four days--the time between the vulnerability being published and Tuesday's patch update. "To release a stable patch for IE would be impossible (in that time) because they want to test it thoroughly before it goes out," Richmond said. "The monthly patch cycle was designed to make it easier for system administrators to schedule their updates, but a few days is just not enough time for Microsoft create and test a patch." Ben English, security team leader at Microsoft Australia, told ZDNet Australia that Microsoft advocates a process of responsible disclosure and is "very keen" to discover any vulnerabilities before they are made public. "The reasons are very obvious. We would not disclose any info about a vulnerability till we have mitigation in place," English said. "The worst scenario for us is that we release an update which has quality problems. We believe the downstream problems of releasing patches too quickly are even more serious than not putting in the quality that they deserve." English would not comment on whether Microsoft thought the timing of the worm's and the vulnerability's disclosure was malicious, but he said that if the problem were serious enough, the company would break its patch cycle to plug the gap. "In terms of the timing, I have no comment on whether there is malicious intent," he said. "But in a sense, it is academic because if this is a serious vulnerability and we have a patch available, we will release it out of cycle." The MyDoom virus, also referred to as a worm, has been dubbed Bofra by some antivirus firms. Munir Kotadia of ZDNet Australia reported from Sydney. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Thu Nov 11 2004 - 03:30:03 PST