Microsoft is facing accusations that it sat on critical flaws for more than two years before patching.The flaws in ActiveX controls for Office were patched in Microsoft's latest security update but according to the security researchers at TippingPoint Technologies, they reported the bugs to Microsoft in March 2007.The firm was reluctant to criticise Microsoft but said the flaws were reported well in advance and were being used by attackers for weeks before the patches were issued.Microsoft maintains that creating patches is more difficult than it is for other companies, since it has a massive install base running different configurations of its software.Each patch must be tested on each system, thus creating a long lead time, but some have questioned why the company took so long on flaws that it described as 'critical'.With many private security researchers reporting flaws to the company, there is a limit to the amount of time that can be spent solving each one, but it seems Microsoft is being laggardly in fixing problems until attacks are reported in the wild.
Issue: 335 | January/February 2015
Access CRN's extensive online resources including; email bulletins, community discussions and unique online news.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can log on to the CRN website or start posting comments on articles.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain '@crn.com.au' to your white-listed senders.