Researchers bypass Microsoft to report Windows flaws
Connecting state and local government leaders
Researchers last week described some issues that possibly affect the security of Windows systems and their components.
Researchers last week described some issues that possibly affect the security of Windows systems and their components.
The Wintercore blog on Tuesday pointed to a memory leak problem associated with the MSHTML.DLL library file used with Internet Explorer 8 on 32-bit and 64-bit versions of Windows XP, Windows Vista and Windows 7. The blog describes the flaw as a zero-day vulnerability that is "not so critical [to fix] but interesting."
No fix is described in the Wintercore blog, and Microsoft hasn't commented on the possible flaw. Apparently, the Wintercore researcher is working outside of Microsoft's "responsible disclosure" (or private reporting) guidelines, which seems to have caused frustration among some researchers.
Full Disclosure reportSecunia also noted the warningThe Microsoft-Spurned Researcher Collective uses a name that mocks that of the Microsoft Security Response Center, which also shares the "MSRC" acronym. The collective issued a statement criticizing Microsoft's response to Tavis Ormandy, a security researcher who works for Google. Ormandy publicized a Windows help function flaw just five days after revealing it to Microsoft. The disclosure put "customers at risk," according to Microsoft. However, the collective suggested that it would freely disclose other such flaws in a public manner.
Microsoft issued a security advisory last month about the Windows help flaw, which affects Windows XP-based systems. Later, after the disclosure by Ormandy, Microsoft said that the flaw was being actively exploited. On June 30, Microsoft stated in a blog post that exploit attempts had become more sophisticated and that more than 10,000 attacks had been attempted between June 15 and June 29.
Security firm Symantec noted last week that a sophisticated attack has been discovered that taps into the Windows help flaw. The attack targeted two unnamed defense contractors using bogus e-mails to get users to visit a malicious Web page and download malware.
Those using Microsoft's security solutions have had protection from the Windows XP help flaw since June 10, according to Microsoft's blog. "We'll continue to monitor this situation and provide updates as appropriate," the Microsoft security team stated. Possibly, Microsoft could issue a fix during this month's security update, scheduled for Tuesday, July 13.
Meanwhile, Secunia this week pointed to a buffer overflow problem in the Windows MFC42.DLL library that may be a "moderately critical" security issue. It affects Windows 2000 Professional Service Pack 4 and Windows XP SP2/SP3. A known attack vector for this vulnerability, which can enable remote code execution attacks, is the PowerZip version 7.2 Build 4010 program, according to Secunia.
Microsoft may issue a patch for MFC42.DLL, but it might be the last one issued for these operating systems since support will be expiring. Windows 2000 and Windows XP SP2 will no longer get security updates after July 13, 2010. A Microsoft Twitter post stated that Microsoft is currently investigating the MFC42.DLL matter.
Lastly, Secunia cited security researcher Soroush Dalili's report of a flaw in Microsoft Internet Information Services 5.1 running on Windows XP SP3. Secunia describes the vulnerability as "moderately critical" to fix, and states that users can avoid it by not relying on "the basic authentication method [of IIS 5.1] to restrict access to resources."