http://news.com.com/Viruses+exploit+Microsoft+patch+cycle/2100-7349_3-5446624.html
By Munir Kotadia
Special to CNET News.com
November 10, 2004
The creators of the latest MyDoom variant, which exploits a recently
discovered iFrame vulnerability in Internet Explorer, may have timed
the release of the viruses to throw Microsoft's monthly patch cycle
into disarray, security experts say.
In its latest monthly update on Tuesday, Microsoft was not able to fix
a serious vulnerability in the Internet Explorer browser because the
flaw was discovered only a few days before the company's regular
update was due. The two variants of the MyDoom virus were released
earlier this week, leaving the software giant without any option but
to ignore the problem--for now.
Sean Richmond, senior technology consultant at Sophos Australia, told
ZDNet Australia that it would have been impossible for Microsoft to
create and test a reliable patch in four days--the time between the
vulnerability being published and Tuesday's patch update.
"To release a stable patch for IE would be impossible (in that time)
because they want to test it thoroughly before it goes out," Richmond
said. "The monthly patch cycle was designed to make it easier for
system administrators to schedule their updates, but a few days is
just not enough time for Microsoft create and test a patch."
Ben English, security team leader at Microsoft Australia, told ZDNet
Australia that Microsoft advocates a process of responsible disclosure
and is "very keen" to discover any vulnerabilities before they are
made public.
"The reasons are very obvious. We would not disclose any info about a
vulnerability till we have mitigation in place," English said. "The
worst scenario for us is that we release an update which has quality
problems. We believe the downstream problems of releasing patches too
quickly are even more serious than not putting in the quality that
they deserve."
English would not comment on whether Microsoft thought the timing of
the worm's and the vulnerability's disclosure was malicious, but he
said that if the problem were serious enough, the company would break
its patch cycle to plug the gap.
"In terms of the timing, I have no comment on whether there is
malicious intent," he said. "But in a sense, it is academic because if
this is a serious vulnerability and we have a patch available, we will
release it out of cycle."
The MyDoom virus, also referred to as a worm, has been dubbed Bofra by
some antivirus firms.
Munir Kotadia of ZDNet Australia reported from Sydney.
_________________________________________
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable -
http://www.osvdb.org/
