Security firm reveals Microsoft's 'silent' patches
Microsoft acknowledges fixing internally-found flaws without disclosing details
Computerworld - Microsoft silently patched three vulnerabilities last month, two of them affecting enterprise mission-critical Exchange mail servers, without calling out the bugs in the accompanying advisories, a security expert said today.
Two of the three unannounced vulnerabilities, and the most serious of the trio, were packaged with MS10-024, an update to Exchange and Windows SMTP Service that Microsoft issued April 13 and tagged as "important," its second-highest threat ranking.
According to Ivan Arce, the chief technology officer of Core Security Technologies, Microsoft patched the bugs, but failed to disclose that it had done so.
"They're more important than the [two vulnerabilities] that Microsoft did disclose," said Arce. "That means [system] administrators may end up making the wrong decisions about applying the update. They need that information to assess the risk."
Core Labs researcher Nicolas Economou discovered the two unspoken bugs while digging into the update, part of his jobs as an exploit writer for Core, which is best known for its Core Impact penetration testing framework, a system for probing computers and networks for potential vulnerabilities by attacking them with real-world exploits.
"An attacker may leverage the two previously undisclosed vulnerabilities fixed by MS10-024 to spoof responses to any DNS query sent by the Windows SMTP service trivially," said Core in its own advisory on Economou's discovery. "DNS response spoofing and cache poisoning attacks are well known to have a variety of security implications with impact beyond just Denial of Service and Information Disclosure as originally stated in MS10-024."
DNS cache poisoning is a long-standing attack tactic -- it goes back nearly two decades -- but is probably best known for the critical vulnerability in the Internet's Domain Name System (DNS) software found by Dan Kaminsky in 2008.
Secret patches are neither new or rare. "This has been going on for many years and the action in and of itself is not a huge conspiracy," said Andrew Storms, director of security operations at nCircle Security.
What is unusual is that Core took Microsoft's silent updates public.
Saying that Microsoft "misrepresented" and "underestimated" the criticality of MS10-024 because it didn't reveal the two bugs, Core urged company administrators to "consider re-assessing patch deployment priorities."
Core found a third unstated April 13 fix in another update, MS10-028. That patch addressed two identified bugs in Microsoft Visio, the company's project diagramming software.
Microsoft acknowledged it had fixed flaws without telling customers, but defended the practice.
"When a security vulnerability is discovered, Microsoft conducts a thorough investigation of that vulnerability, addresses any other issues found in the code as a result of that investigation and subjects the security updates to extensive testing for quality assurance," said Jerry Bryant, a security program manager, in an e-mail. "This helps reduce the number of updates customers have to deploy, since updating can be disruptive to customer environments."
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- 10 Things Your Next Firewall Must do Next-Generation Firewalls Defined
- Firewall Buyers Guide Operate as the core of your network security infrastructure
- Getting Started With a Zero Trust Approach to Network Security The Traditional Approach to Network Security is Failing. View Now>>
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts