Security firm reveals Microsoft's 'silent' patches
Microsoft acknowledges fixing internally-found flaws without disclosing details
Computerworld - Microsoft silently patched three vulnerabilities last month, two of them affecting enterprise mission-critical Exchange mail servers, without calling out the bugs in the accompanying advisories, a security expert said today.
Two of the three unannounced vulnerabilities, and the most serious of the trio, were packaged with MS10-024, an update to Exchange and Windows SMTP Service that Microsoft issued April 13 and tagged as "important," its second-highest threat ranking.
According to Ivan Arce, the chief technology officer of Core Security Technologies, Microsoft patched the bugs, but failed to disclose that it had done so.
"They're more important than the [two vulnerabilities] that Microsoft did disclose," said Arce. "That means [system] administrators may end up making the wrong decisions about applying the update. They need that information to assess the risk."
Core Labs researcher Nicolas Economou discovered the two unspoken bugs while digging into the update, part of his jobs as an exploit writer for Core, which is best known for its Core Impact penetration testing framework, a system for probing computers and networks for potential vulnerabilities by attacking them with real-world exploits.
"An attacker may leverage the two previously undisclosed vulnerabilities fixed by MS10-024 to spoof responses to any DNS query sent by the Windows SMTP service trivially," said Core in its own advisory on Economou's discovery. "DNS response spoofing and cache poisoning attacks are well known to have a variety of security implications with impact beyond just Denial of Service and Information Disclosure as originally stated in MS10-024."
DNS cache poisoning is a long-standing attack tactic -- it goes back nearly two decades -- but is probably best known for the critical vulnerability in the Internet's Domain Name System (DNS) software found by Dan Kaminsky in 2008.
Secret patches are neither new or rare. "This has been going on for many years and the action in and of itself is not a huge conspiracy," said Andrew Storms, director of security operations at nCircle Security.
What is unusual is that Core took Microsoft's silent updates public.
Saying that Microsoft "misrepresented" and "underestimated" the criticality of MS10-024 because it didn't reveal the two bugs, Core urged company administrators to "consider re-assessing patch deployment priorities."
Core found a third unstated April 13 fix in another update, MS10-028. That patch addressed two identified bugs in Microsoft Visio, the company's project diagramming software.
Microsoft acknowledged it had fixed flaws without telling customers, but defended the practice.
"When a security vulnerability is discovered, Microsoft conducts a thorough investigation of that vulnerability, addresses any other issues found in the code as a result of that investigation and subjects the security updates to extensive testing for quality assurance," said Jerry Bryant, a security program manager, in an e-mail. "This helps reduce the number of updates customers have to deploy, since updating can be disruptive to customer environments."
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts