We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,797 News Articles

Microsoft leaves bug unpatched for three years

Symantec 'concerned' about Microsoft strategy

Microsoft has admitted it failed to patch bugs in its Jet Database Engine despite knowing of the exploit as far back as 2005.

A researcher at Symantec said Microsoft should have fixed the flaws years ago, but Microsoft said it thought it had blocked the obvious attack vector.

In a post to the Microsoft Security Research Center (MSRC) blog, Mike Reavey, the MSRC's operations manager, admitted that outside researchers had notified Microsoft in 2005 and 2007 of separate bugs in Jet, a Windows component that provides data access to applications such as Microsoft Access and Visual Basic.

In both cases, Microsoft had told the researchers that it would not fix the flaw because it considered users safe. Outlook blocked the .mdb file format from being opened, Exchange servers stripped them from incoming email and Internet Explorer issued warnings when users clicked on such files, said Reavey in explaining Microsoft's decision.

The company hadn't thought of the attack strategy now being used by hackers, however. "Everything changed with the discovery of this new attack vector that allowed an attacker to load an MDB file via opening a Microsoft Word document," he said. "The previous guidance does not work against this new attack. So that's why we alerted customers to these attacks and are re-investigating Jet parsing flaws - this is a new attack vector discovered that we didn't know about previously."

Attackers are, in fact, doing an end-run around Outlook, researchers at Symantec said last week when they released findings that prompted Microsoft to issue a security advisory warning users running Word on Windows 2000, XP and Server 2003 SP1 to take defensive steps.

One researcher said Microsoft could have done more earlier to prevent the sudden scramble for a fix.

"I can't count the number of times we've seen this in the past with a Microsoft product," said Oliver Friedrichs, a director with Symantec's security response team. "Clearly, there should have been more concern from Microsoft in the first place. There have been two vulnerabilities, one in 2005 and another in 2007, and both were left unpatched.

"It does draw some concern," Friedrichs said.

The MSRC is still working out how it wants to patch the vulnerability or throw up more barriers to the now-known attack through malicious Word documents. It may try to stop those documents from loading .mdb files without prompting the user, or it may include a newer version of Jet - one already plugged into Windows Vista, Windows Server 2003 SP2 and slated for Windows XP SP3 - with any fix.

See Business Advisor for the latest technology news, reviews and tutorials, plus the chance to win a Dell laptop


IDG UK Sites

Android One vs Android Silver vs Google Nexus: What is the difference?

IDG UK Sites

Apple updates MacBook Pro line-up: Price cuts & spec boosts for 6 MacBook Pro models

IDG UK Sites

Long live the internet fridge: the Internet of Things is coming

IDG UK Sites

How Prometheus' colourist Juan Ignacio Cabrera gave a tense, edgy feel to Chosen