Microsoft explains Windows URI patch strategy

Security team tries to clear up confusion over what it will patch and what it won't

Microsoft has clarified what it plans to patch to fix a bug in Windows XP and Server 2003, but said it had no plans to overhaul the operating system's protocol-handling technology.

Mark Miller, director of the Microsoft Security Response Center (MSRC), and Mike Reavey, the MSRC's operations manager, acknowledged there was confusion around its decision to patch a vulnerability in Windows XP and Windows Server 2003 on systems running Internet Explorer 7.

"There are two separate issues," said Miller, referring to the Universal Resource Identifier (URI) bug in Windows that was the focus of a security advisory issued last week, and a larger problem that first surfaced in June but gained traction in July. "The issue [from] back in June is really related to protocol handling, and is really around how third-party applications handle them," Miller said.

Starting four months ago, researchers uncovered vulnerabilities in applications such as Apple's Safari for Windows and Mozilla's Firefox that were traced to Windows' protocol handling, the technology that lets browsers run other programs via commands in the URL. In July, criticism mounted as some researchers said Microsoft bore full responsibility for the flaws, which could be used to hijack PCs. Others, however, defended Windows, saying it was the applications' duty to "sanitize" -- to guarantee that the URIs didn't allow invalid input -- the URLs they passed to the operating system.

"The answer is yes and no," said Reavey, when asked whether Microsoft was responsible for patching. Protocol handlers registered by Windows are its responsibility, he said, and will be fixed when flaws are found, but plugging holes in handlers registered by third-party developers is not Microsoft's job.

The most common protocols, such as mailto:, which opens the default e-mail client and pre-addresses the To: field after a user clinks a mailto: link, are Microsoft's. But other developers register protocol handlers as well. Mozilla, for example, registers a protocol handler dubbed "firefoxurl:" that's used to open another instance of Firefox.

Microsoft's decision to patch bugs in protocol handlers registered by Windows is the logical move, said Ben Greenbaum, a senior manager with Symantec's security response team. "Their software is on both sides of the Windows XP-Internet Explorer 7 vulnerability," said Greenbaum, "so they should be looking at patching that issue."

"If the protocol is one that Windows handles, we understand it's up to us to patch it," said Reavey. "Mailto: wasn't the problem, it's a problem in how Windows handles protocols."

But when asked if his team would revisit Windows' processing of third-party protocol handlers, Miller made it clear that at the present, Microsoft had no intention of changing anything. "We have no plans," he said. Other developers must secure the protocols they register, he continued. "The IE team did a very good blog post on this back in July."

Microsoft has not set a timetable for delivering the announced Windows XP and Windows 2003 patch. Likewise, it has only described the fix in general terms, saying Thursday that it would "revise our URI handling code within ShellExecute to be more strict." Miller, who declined to get more specific about either the schedule or the details, said: "The update will be part of our normal product update process. It will be released as soon as we feel it's ready."

At least one researcher thinks Microsoft should do more than just patch its own problems. "Part of the larger issue here is that vendors lack a clear standard on what is and what is not approved to be stuffed into these extended URL areas," said Andrew Storms, the director of security operations at nCircle Network Security. By the time a code snippet makes its way to the final executing program, the program is so far removed from the browser, it has no idea what has been sanitized, what has been escaped or what kind of information has been approved to be in the permitted list of data."

More importantly, added Symantec's Greenbaum, is that the debates over protocol handling vulnerabilities and patch responsibility have major implications in a Web 2.0 world. "This gets to the heart of secure coding and secure data," he said. "It's early, but the decisions made on this class of vulnerabilities could determine the long-range security of the Internet."

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?