Microsoft explains seven-year-old patch delay

'I'm bummed it didn't get fixed then,' says former Microsoft security expert

Microsoft Tuesday explained why it had been unable to patch a seven-year-old bug until recently, saying that it was only in the last year that it figured out how to fix the flaw without breaking most network-based applications.

The bug in Microsoft's SMB (Server Message Block) protocol, which is used by Windows to share files and printers over a network, was patched Tuesday as part of the company's normal monthly security updates. What stood out, however, wasn't the fix as much as the time it took Microsoft to come up with a patch.

In a post to the Microsoft Security Response Center (MSRC) blog, MSRC spokesman Christopher Budd acknowledged the seven-year stretch between the time when the vulnerability was first discussed and the patch. Then he launched into an explanation.

"When this issue was first raised back in 2001, we said that we could not make changes to address this issue without negatively impacting network-based applications," Budd said. "And to be clear, the impact would have been to render many, or nearly all, customers' network-based applications then inoperable."

Rather than break applications, Microsoft passed on a patch, and instead told companies they could protect themselves by using SMB signing, though that, too, wasn't a panacea. "The reality was that there were similar constraints that made it infeasible for customers to implement SMB signing," Budd admitted.

In the meantime, SMB relay attacks, the term given to the original proof-of-concept crafted in 2001 by a hacker using the alias "Sir Dystic," were feasible if not actually in-the-wild.

But Microsoft didn't drop the matter, Budd said. "Over the course of the past year, however, ongoing work showed us a way to ... address the issues outlined in the SMBRelay attack and also minimize the impact on network applications," he said. The result: Tuesday's patch.

The explanation rang true to Eric Schultze, the chief technology officer at Shavlik Technologies, a security company. Schultze, who once worked for Microsoft and the MSRC, said he had been the one to bring the SMB relay attack to the attention of the company.

"I think it does make sense," said Schultze, referring to Budd's reasoning. "I pushed hard for a fix to this in 2001, and we ended up having a meeting with the OS and IE teams. At first we thought it was mitigated in IE, but that only worked for non-OS calls to SMB. This was actually different. That took a while for everyone to understand."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags microsoft patches

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?