4 ms·
"A quick change in the settings on Word by customers would do the trick, but if Microsoft notified customers about the bug and the recommended changes, it would
by yitchelle 10y ago
"A quick change in the settings on Word by customers would do the trick, but if Microsoft notified customers about the bug and the recommended changes, it would also be telling hackers about how to break in."
In their monthly update, couldn't Microsoft have released a patch to have this setting to the correct configuration? Of course this would only be the short term solution, rather than waiting for 9 months for the permanent solution.
- teh_klev 10y agoI guess the reason is that by studying the patch, even a short term workaround such as this, you can deduce what the vulnerability is and quickly knock out a working exploit. I'm not suggesting that security-through-obscurity was the correct choice by MS, or the time taken to build a comprehensive fix was acceptable, but from the article it seems that this has been a bit of a gnarly issue to solve properly and even a cursory fix might reveal deeper seated issues. I'm not defending MS here, but I imagine that Word's codebase is a helluva pile of cards to work on. Especially given that it can still open document formats such as WordPerfect 5 which date back to 1988. Add in all the legacy OLE automation stuff, a VBA environment and all those shims and backwards compatibility things that MS are known for (see Old New Thing blog) that translates as "One Does Not Simply Patch Word".