12 ms·

This is not the first time Google has disclosed unpatched vulns in Microsoft product [1]. Anyone know any more? What's up with them not being able to patch on

by andreyf 10y ago

This is not the first time Google has disclosed unpatched vulns in Microsoft product [1]. Anyone know any more? What's up with them not being able to patch on time? How is 90 days not enough to get a patch out the door? That's a quarter, for goodness' sake! 1. https://news.ycombinator.com/item?id=12841672 https://news.ycombinator.com/item?id=12841672

mtgx 10y ago
To make matters worse, Microsoft has just completely skipped this month's patch bundle. As in no other security bug will be fixed until next month.
- DangerousPie 10y ago
  Presumably these two facts are related? I would assume this was supposed to get patched this month within the 90 day deadline but some last minute issue delayed the patch.
  - mtgx 10y ago
    They probably are. However, I also expect them to be related because of Microoft's own decisions of integrating security patches with one another, instead of keeping them more modular: the so called "patch bundle" policy. It's hard to believe that say some Flash bug couldn't be patched because of some other unrelated bug. But I hope Microsoft can prove me wrong and explain in detail next month why it couldn't deliver any of the 20-30+ bug patches because of a couple of other unrelated and broken patches.
- mrpippy 10y ago
  They still release "out-of-band" patches for critical security bugs. There was one a few days ago for Flash Player that presumably would have been in February's patch bundle but was too important to wait for the next one.
  - ocdtrekkie 10y ago
    Yes, but Flash Player updates are always pushed as separate items from the Cumulative Update. They are much less likely to push an out-of-band CU, especially when it sounds like they botched their last CU.
- gcr 10y ago
  Next month is tomorrow...?
  - dublinben 10y ago
    Microsoft's monthly patches are released on the second Tuesday of the month. So that's two weeks away.
alistproducer2 10y ago
To be fair to MS, a local bank switched their systems and introduced a vuln that leaves the username and password in the form as it opens the account in a new tab. It's still there 3 weeks later. Edit: This is sarcasm but the bank story is true.
tajen 10y ago
Google also has full interest in showing Microsoft failures. Microsoft could do the same about Chrome. How goid are competitive markets.
- jacquesm 10y ago
  Sad to see this downvoted, but it's definitely war of some sort between Google and Microsoft and Google actively targeting MS products could easily be a factor. Altruism it likely isn't. Keep in mind that the Google docs/drive/whatever suite is the competitor for Microsofts Office 365 product. Has Google ever released info about an unpatched critical bug on their own systems/applications?
  - kps 10y ago
    > Has Google ever released info about an unpatched critical bug on their own systems/applications? https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label%3ADeadline-Exceeded+label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
    - jacquesm 10y ago
      Thank you for digging that up. Are those critical? Not according to the text accompanying them, or am I missing something.
      - andreyf 10y ago
        This one seems pretty bad: https://bugs.chromium.org/p/project-zero/issues/detail?id=1000&can=1&q=label%3ADeadline-Exceeded%20label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/detail?id=10...
        jacquesm 10y ago
        Yes, but when the deadline expired the APK part was already fixed, the remainder is still open.
tptacek 10y ago
The P0 people at Google are apparently surprised about this as well, so expect the answer here to be complicated. Three possibilities among many: 1. Reliable exploitation might be difficult in such a way that the P0 people know how to get an exploit working, but Microsoft doesn't, and so it got deprioritized. A related (less likely) possibility is that the bug simply isn't easily exploitable in the configuration Microsoft ships, or expects to be shipping, these browsers in, due to environment differences in Google's testing lab. 2. Patching the bug might be more difficult than P0 anticipated (it might break compat, for instance). 3. The bug may be part of a pattern which is apparent to Microsoft but not to P0, so they may be holding off to get everything patched all at once rather than release an incremental patch that tips attackers off to a bunch more vulnerabilities. Communication between P0 and other vendors isn't always great. (I think this is the fault of other vendors, by the way, and not P0).
- mrpippy 10y ago
  Unfortunately the issue has no log of communications with Microsoft, this is something we usually see in P0 issues from taviso and others. Not sure why it isn't included in this case.
- deleted 10y ago
  [deleted]
user5994461 10y ago
Because it takes time to write a fix, test it, test it some more to make sure it doesn't break any of you 1 billion users, then ship it, then wait some more because people ain't updating that often. That's in total contrast to web development where you can deploy a fix in ~ 1 hour to all your users simultaneously.
- bArray 10y ago
  > Because it takes time to write a fix, test it, test it some more to make sure it doesn't break any of you 1 billion users, then ship it, Hasn't stopped Microsoft pushing bad updates in the past. > then wait some more because people ain't updating that often. That's a problem with their update model, security waits for nobody.
- ballenf 10y ago
  MS could have also chosen to push a fix that crippled CSS on table header rows or whatnot. Web rendering would break and users would complain, but at least users wouldn't have been intentionally exposed. It's a false dichotomy to suggest that MS's only options were an actual fix vs. do nothing. There are always other options.
- wdr1 10y ago
  > Because it takes time to write a fix, test it, test it some more to make sure it doesn't break any of you 1 billion users, then ship it, then wait some more because people ain't updating that often. Why does IE have a problem with this whereas other popular browsers do not?
sqldba 10y ago
Microsoft missed their February patch release cycle. It's likely due to that.

by andreyf 10y ago

mtgx 10y ago

To make matters worse, Microsoft has just completely skipped this month's patch bundle. As in no other security bug will be fixed until next month.

DangerousPie 10y ago
Presumably these two facts are related? I would assume this was supposed to get patched this month within the 90 day deadline but some last minute issue delayed the patch.
- mtgx 10y ago
  They probably are. However, I also expect them to be related because of Microoft's own decisions of integrating security patches with one another, instead of keeping them more modular: the so called "patch bundle" policy. It's hard to believe that say some Flash bug couldn't be patched because of some other unrelated bug. But I hope Microsoft can prove me wrong and explain in detail next month why it couldn't deliver any of the 20-30+ bug patches because of a couple of other unrelated and broken patches.
mrpippy 10y ago
They still release "out-of-band" patches for critical security bugs. There was one a few days ago for Flash Player that presumably would have been in February's patch bundle but was too important to wait for the next one.
- ocdtrekkie 10y ago
  Yes, but Flash Player updates are always pushed as separate items from the Cumulative Update. They are much less likely to push an out-of-band CU, especially when it sounds like they botched their last CU.
gcr 10y ago
Next month is tomorrow...?
- dublinben 10y ago
  Microsoft's monthly patches are released on the second Tuesday of the month. So that's two weeks away.

alistproducer2 10y ago

To be fair to MS, a local bank switched their systems and introduced a vuln that leaves the username and password in the form as it opens the account in a new tab. It's still there 3 weeks later. Edit: This is sarcasm but the bank story is true.

tajen 10y ago

Google also has full interest in showing Microsoft failures. Microsoft could do the same about Chrome. How goid are competitive markets.

jacquesm 10y ago
Sad to see this downvoted, but it's definitely war of some sort between Google and Microsoft and Google actively targeting MS products could easily be a factor. Altruism it likely isn't. Keep in mind that the Google docs/drive/whatever suite is the competitor for Microsofts Office 365 product. Has Google ever released info about an unpatched critical bug on their own systems/applications?
- kps 10y ago
  > Has Google ever released info about an unpatched critical bug on their own systems/applications? https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=label%3ADeadline-Exceeded+label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
  - jacquesm 10y ago
    Thank you for digging that up. Are those critical? Not according to the text accompanying them, or am I missing something.
    - andreyf 10y ago
      This one seems pretty bad: https://bugs.chromium.org/p/project-zero/issues/detail?id=1000&can=1&q=label%3ADeadline-Exceeded%20label%3AVendor-Google https://bugs.chromium.org/p/project-zero/issues/detail?id=10...
      - jacquesm 10y ago
        Yes, but when the deadline expired the APK part was already fixed, the remainder is still open.

tptacek 10y ago

The P0 people at Google are apparently surprised about this as well, so expect the answer here to be complicated. Three possibilities among many: 1. Reliable exploitation might be difficult in such a way that the P0 people know how to get an exploit working, but Microsoft doesn't, and so it got deprioritized. A related (less likely) possibility is that the bug simply isn't easily exploitable in the configuration Microsoft ships, or expects to be shipping, these browsers in, due to environment differences in Google's testing lab. 2. Patching the bug might be more difficult than P0 anticipated (it might break compat, for instance). 3. The bug may be part of a pattern which is apparent to Microsoft but not to P0, so they may be holding off to get everything patched all at once rather than release an incremental patch that tips attackers off to a bunch more vulnerabilities. Communication between P0 and other vendors isn't always great. (I think this is the fault of other vendors, by the way, and not P0).

mrpippy 10y ago
Unfortunately the issue has no log of communications with Microsoft, this is something we usually see in P0 issues from taviso and others. Not sure why it isn't included in this case.
deleted 10y ago
[deleted]

user5994461 10y ago

Because it takes time to write a fix, test it, test it some more to make sure it doesn't break any of you 1 billion users, then ship it, then wait some more because people ain't updating that often. That's in total contrast to web development where you can deploy a fix in ~ 1 hour to all your users simultaneously.

bArray 10y ago
> Because it takes time to write a fix, test it, test it some more to make sure it doesn't break any of you 1 billion users, then ship it, Hasn't stopped Microsoft pushing bad updates in the past. > then wait some more because people ain't updating that often. That's a problem with their update model, security waits for nobody.
ballenf 10y ago
MS could have also chosen to push a fix that crippled CSS on table header rows or whatnot. Web rendering would break and users would complain, but at least users wouldn't have been intentionally exposed. It's a false dichotomy to suggest that MS's only options were an actual fix vs. do nothing. There are always other options.
wdr1 10y ago
> Because it takes time to write a fix, test it, test it some more to make sure it doesn't break any of you 1 billion users, then ship it, then wait some more because people ain't updating that often. Why does IE have a problem with this whereas other popular browsers do not?

sqldba 10y ago

Microsoft missed their February patch release cycle. It's likely due to that.