Microsoft explains seven-year-old patch delay

Computerworld - Microsoft Corp. late yesterday explained why it had been unable to patch a seven-year-old bug until recently, saying that it was only in the last year that it figured out how to fix the flaw without breaking most network-based applications.

The bug in Microsoft's SMB (Server Message Block) protocol, which is used by Windows to share files and printers over a network, was patched Tuesday as part of the company's normal monthly security updates. What stood out, however, wasn't the fix as much as the time it took Microsoft to come up with a patch.

In a post to the Microsoft Security Response Center blog, MSRC spokesman Christopher Budd acknowledged the seven-year stretch between the time when the vulnerability was first discussed and when the patch was released. Then he launched into an explanation.

"When this issue was first raised back in 2001, we said that we could not make changes to address this issue without negatively impacting network-based applications," Budd said. "And to be clear, the impact would have been to render many, or nearly all, customers' network-based applications then inoperable."

Rather than break applications, Microsoft passed on a patch and instead told companies they could protect themselves by using SMB signing, though that also wasn't a panacea. "The reality was that there were similar constraints that made it infeasible for customers to implement SMB signing," Budd admitted.

In the meantime, SMB relay attacks, the term given to the original proof-of-concept crafted in 2001 by a hacker using the alias "Sir Dystic," were feasible if not actually in the wild.

But Microsoft didn't drop the matter, Budd said. "Over the course of the past year, however, ongoing work showed us a way to ... address the issues outlined in the SMBRelay attack and also minimize the impact on network applications," he said. The result: yesterday's patch.

The explanation rang true to Eric Schultze, the chief technology officer at Shavlik Technologies LLC, a St. Paul, Minn.-based security company. Schultze, who once worked for Microsoft and the MSRC, said he had been the one to bring the SMB relay attack to the attention of the company.

"I think it does make sense," said Schultze, referring to Budd's reasoning. "I pushed hard for a fix to this in 2001, and we ended up having a meeting with the OS and [Internet Explorer] teams. At first, we thought it was mitigated in IE, but that only worked for non-OS calls to SMB. This was actually different. That took a while for everyone to understand."

In 2001, when Schultze worked on the SMB relay attack problem, it was impossible to patch. "Chris [Budd] may be embellishing it a little, saying that applications would break, but essentially, yes, it was too difficult to fix," said Schultze. "At that point, the IE team was pointing to the OS team, and the OS team was pointing at the IE team."

So why fix it now?

"It looks like Microsoft has been noodling on this for a while, and they came up with a way to solve the problem," Schultze said. "We probably could have solved it back then if we'd had a few months to noodle on it."

Microsoft may have been prompted to act by the appearance earlier this year of an SMB relay attack module for the popular open-source Metasploit penetration and attack framework, argued Schultze. "It looks like exploit code came out in the last four or five months," he said, which made it easier for someone to create the Metasploit module.

"And Microsoft has a different security point now than 2001," Schultze added, referring to the increased emphasis that the company has put into security since before the 2004 debut of Windows XP Service Pack 2. "I'm kind of bummed, though," he said. "I'm glad the [SMB relay attack] bug has been fixed, but I'm bummed that it didn't get fixed back then."

Read more about security in Computerworld's Security Knowledge Center.