Update: Microsoft admits it knew about, didn't patch, bugs
It thought users were safe, but is now scrambling for a solution
Computerworld - Microsoft Corp.'s security team today acknowledged that it knew of bugs in its Jet Database Engine as far back as 2005 but did not patch the problems because it thought it had blocked the obvious attack vectors.
A researcher at Symantec Corp. said Microsoft should have fixed the flaws years ago.
In a post to the Microsoft Security Research Center (MSRC) blog late Monday afternoon, Mike Reavey, the MSRC's operations manager, admitted that outside researchers had notified Microsoft in 2005 and 2007 of separate bugs in Jet, a Windows component that provides data access to applications such as Microsoft Access and Visual Basic.
In both cases, Microsoft told the researchers that it would not fix the flaw because it considered users safe. Outlook blocked the .mdb file format from being opened, Exchange servers stripped them from incoming messages and Internet Explorer issued warnings when users clicked on such files, said Reavey as he explained Microsoft's decision.
But the company hadn't thought of the attack strategy now being used by hackers. "Everything changed with the discovery of this new attack vector that allowed an attacker to load an .mdb file via opening a Microsoft Word document," he said. "The previous guidance does not work against this new attack. So that's why we alerted customers to these attacks and are re-investigating Jet parsing flaws -- this is a new attack vector discovered that we didn't know about."
Attackers are, in fact, doing an end run around Outlook, researchers at Symantec said last week. That finding prompted Microsoft to issue a security advisory warning users running Word on Windows 2000, XP and Server 2003 SP1 to take defensive steps.
One researcher said today that Microsoft could have done more -- and done something earlier -- to prevent the sudden scramble for a fix.
"I can't count the number of times we've seen this in the past with a Microsoft product," said Oliver Friedrichs, a director with Symantec's security response team. "Clearly, there should have been more concern from Microsoft in the first place. There have been two vulnerabilities, one in 2005 and another in 2007, and both were left unpatched.
"It does draw some concern," Friedrichs said.
The MSRC is still working out how it wants to patch the vulnerability or whether it can put up more barriers to the now-known Word attack. It may block Word documents from automatically loading .mdb files, Reavey said, or it may replace the version of Jet in Windows 2000, XP and Server 2003 SP1 with a newer edition that doesn't contain the bug. The new Jet Database Engine is part of Windows Vista and Windows Server 2003 SP2, and it is slated for inclusion in Windows XP SP3, making those operating systems immune to attacks.
Reavey did not provide any additional details on a patch timeline. Last Friday, an MSRC spokesman said a fix might come as a so-called "out-of-band" release -- in other words, before the next scheduled general security update, which is due April 8.
No matter what kind of patch it produces or when it pushes a fix to users, Microsoft can't change the .mdb file format to make it less dangerous, according to Reavey. "Jet database files (file type .mdb) will remain on the unsafe file type list because they can run code by design," he noted. "Even if we tried to, we could not secure this file format, it will always present attackers an opportunity to run code."
Until a patch is released, Reavey repeated advice that both Microsoft and Symantec gave last week: disable Jet or block .mdb files at the gateway.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Taking Windows Mobile on Any Device Taking Windows applications mobile has many advantages, but the process of identifying a solution is complex. Learn how to solve this complex problem...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Windows White Papers | Webcasts