Security firm reveals Microsoft's 'silent' patches

Computerworld - Microsoft silently patched three vulnerabilities last month, two of them affecting enterprise mission-critical Exchange mail servers, without calling out the bugs in the accompanying advisories, a security expert said today.

Two of the three unannounced vulnerabilities, and the most serious of the trio, were packaged with MS10-024, an update to Exchange and Windows SMTP Service that Microsoft issued April 13 and tagged as "important," its second-highest threat ranking.

According to Ivan Arce, the chief technology officer of Core Security Technologies, Microsoft patched the bugs, but failed to disclose that it had done so.

"They're more important than the [two vulnerabilities] that Microsoft did disclose," said Arce. "That means [system] administrators may end up making the wrong decisions about applying the update. They need that information to assess the risk."

Core Labs researcher Nicolas Economou discovered the two unspoken bugs while digging into the update, part of his jobs as an exploit writer for Core, which is best known for its Core Impact penetration testing framework, a system for probing computers and networks for potential vulnerabilities by attacking them with real-world exploits.

"An attacker may leverage the two previously undisclosed vulnerabilities fixed by MS10-024 to spoof responses to any DNS query sent by the Windows SMTP service trivially," said Core in its own advisory on Economou's discovery. "DNS response spoofing and cache poisoning attacks are well known to have a variety of security implications with impact beyond just Denial of Service and Information Disclosure as originally stated in MS10-024."

DNS cache poisoning is a long-standing attack tactic -- it goes back nearly two decades -- but is probably best known for the critical vulnerability in the Internet's Domain Name System (DNS) software found by Dan Kaminsky in 2008.

Secret patches are neither new or rare. "This has been going on for many years and the action in and of itself is not a huge conspiracy," said Andrew Storms, director of security operations at nCircle Security.

What is unusual is that Core took Microsoft's silent updates public.

Saying that Microsoft "misrepresented" and "underestimated" the criticality of MS10-024 because it didn't reveal the two bugs, Core urged company administrators to "consider re-assessing patch deployment priorities."

Core found a third unstated April 13 fix in another update, MS10-028. That patch addressed two identified bugs in Microsoft Visio, the company's project diagramming software.

Microsoft acknowledged it had fixed flaws without telling customers, but defended the practice.

"When a security vulnerability is discovered, Microsoft conducts a thorough investigation of that vulnerability, addresses any other issues found in the code as a result of that investigation and subjects the security updates to extensive testing for quality assurance," said Jerry Bryant, a security program manager, in an e-mail. "This helps reduce the number of updates customers have to deploy, since updating can be disruptive to customer environments."