Security firm reveals Microsoft's 'silent' patches
Microsoft acknowledges fixing internally-found flaws without disclosing details
Computerworld - Microsoft silently patched three vulnerabilities last month, two of them affecting enterprise mission-critical Exchange mail servers, without calling out the bugs in the accompanying advisories, a security expert said today.
Two of the three unannounced vulnerabilities, and the most serious of the trio, were packaged with MS10-024, an update to Exchange and Windows SMTP Service that Microsoft issued April 13 and tagged as "important," its second-highest threat ranking.
According to Ivan Arce, the chief technology officer of Core Security Technologies, Microsoft patched the bugs, but failed to disclose that it had done so.
"They're more important than the [two vulnerabilities] that Microsoft did disclose," said Arce. "That means [system] administrators may end up making the wrong decisions about applying the update. They need that information to assess the risk."
Core Labs researcher Nicolas Economou discovered the two unspoken bugs while digging into the update, part of his jobs as an exploit writer for Core, which is best known for its Core Impact penetration testing framework, a system for probing computers and networks for potential vulnerabilities by attacking them with real-world exploits.
"An attacker may leverage the two previously undisclosed vulnerabilities fixed by MS10-024 to spoof responses to any DNS query sent by the Windows SMTP service trivially," said Core in its own advisory on Economou's discovery. "DNS response spoofing and cache poisoning attacks are well known to have a variety of security implications with impact beyond just Denial of Service and Information Disclosure as originally stated in MS10-024."
DNS cache poisoning is a long-standing attack tactic -- it goes back nearly two decades -- but is probably best known for the critical vulnerability in the Internet's Domain Name System (DNS) software found by Dan Kaminsky in 2008.
Secret patches are neither new or rare. "This has been going on for many years and the action in and of itself is not a huge conspiracy," said Andrew Storms, director of security operations at nCircle Security.
What is unusual is that Core took Microsoft's silent updates public.
Saying that Microsoft "misrepresented" and "underestimated" the criticality of MS10-024 because it didn't reveal the two bugs, Core urged company administrators to "consider re-assessing patch deployment priorities."
Core found a third unstated April 13 fix in another update, MS10-028. That patch addressed two identified bugs in Microsoft Visio, the company's project diagramming software.
Microsoft acknowledged it had fixed flaws without telling customers, but defended the practice.
"When a security vulnerability is discovered, Microsoft conducts a thorough investigation of that vulnerability, addresses any other issues found in the code as a result of that investigation and subjects the security updates to extensive testing for quality assurance," said Jerry Bryant, a security program manager, in an e-mail. "This helps reduce the number of updates customers have to deploy, since updating can be disruptive to customer environments."
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!