Microsoft sat on critical flaw for two years

By Iain Thomson on Aug 15, 2009 9:43 AM
Filed under Technology

Patch Tuesday ActiveX flaw reported in 2007.

Microsoft is facing accusations that it sat on critical flaws for more than two years before patching.

The flaws in ActiveX controls for Office were patched in Microsoft's latest security update but according to the security researchers at TippingPoint Technologies, they reported the bugs to Microsoft in March 2007.

The firm was reluctant to criticise Microsoft but said the flaws were reported well in advance and were being used by attackers for weeks before the patches were issued.

Microsoft maintains that creating patches is more difficult than it is for other companies, since it has a massive install base running different configurations of its software.

Each patch must be tested on each system, thus creating a long lead time, but some have questioned why the company took so long on flaws that it described as 'critical'.

With many private security researchers reporting flaws to the company, there is a limit to the amount of time that can be spent solving each one, but it seems Microsoft is being laggardly in fixing problems until attacks are reported in the wild.

 
Follow us on Facebook and Twitter
 

Copyright ©v3.co.uk

Promo

Microsoft sat on critical flaw for two years
 
 
 
 
 
Top Stories
Sydney Cisco school supplier hits the skids
Appoints administrator after Westcon wind-up notice.
 
Dicker Data ditches old logo, rebrands for "new era"
Will also shelve Express Data name.
 
Vocus buys 14.5% stake in Macquarie Telecom
Value of acquisitions to hit $150m in a year.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
Do grey market imports hurt your business?

Latest Comments
CRN Magazine

Issue: 336 | March 2015

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.