Microsoft admits it knew about, but didn't patch, bugs

It thought users were safe, but is now scrambling for a solution

Microsoft's security team Tuesday acknowledged that it knew of bugs in its Jet Database Engine as far bask as 2005 but did not patch the problems because it thought it had blocked the obvious attack vector.

A researcher at Symantec said Microsoft should have fixed the flaws years ago.

In a post to the Microsoft Security Research Center (MSRC) blog late Monday afternoon, Mike Reavey, the MSRC's operations manager, admitted that outside researchers had notified Microsoft in 2005 and 2007 of separate bugs in Jet, a Windows component that provides data access to applications such as Microsoft Access and Visual Basic.

In both cases, Microsoft had told the researchers that it would not fix the flaw because it considered users safe. Outlook blocked the .mdb file format from being opened, Exchange servers stripped them from incoming e-mail and Internet Explorer issued warnings when users clicked on such files, said Reavey in explaining Microsoft's decision.

The company hadn't thought of the attack strategy now being used by hackers, however. "Everything changed with the discovery of this new attack vector that allowed an attacker to load an MDB file via opening a Microsoft Word document," he said. "The previous guidance does not work against this new attack. So that's why we alerted customers to these attacks and are re-investigating Jet parsing flaws -- this is a new attack vector discovered that we didn't know about previously."

Attackers are, in fact, doing an end-run around Outlook, researchers at Symantec said last week when they released findings that prompted Microsoft to issue a security advisory warning users running Word on Windows 2000, XP and Server 2003 SP1 to take defensive steps.

One researcher said Microsoft could have done more earlier to prevent the sudden scramble for a fix.

"I can't count the number of times we've seen this in the past with a Microsoft product," said Oliver Friedrichs, a director with Symantec's security response team. "Clearly, there should have been more concern from Microsoft in the first place. There have been two vulnerabilities, one in 2005 and another in 2007, and both were left unpatched.

"It does draw some concern," Friedrichs said.

The MSRC is still working out how it wants to patch the vulnerability or throw up more barriers to the now-known attack through malicious Word documents. It may try to stop those documents from loading .mdb files without prompting the user, or it may include a newer version of Jet -- one already plugged into Windows Vista, Windows Server 2003 SP2 and slated for Windows XP SP3 -- with any fix.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?