You should already know about this...

re: You should already know about this...

Kevin Remde — Sat, 07 Jan 2006 17:50:27 GMT

Oh, I agree with that too, Vlad. That also weighs into the calcuation. Along with that was the fact that when there are known workarounds, then we might have a way to help the network owners protect themselves in the meantime.

re: You should already know about this...

Vlad Mazek — Sat, 07 Jan 2006 00:58:08 GMT

Tony,

I concede my wording left a lot to be desired. Yes, it was rated critical and there was an exploit, however, the exploit was wasted on driving traffic to an adware site which from my standpoint is not as damaging as perhaps a DDoS or sending clients private information.

I guess what I wanted to say is that while we were not damaged by the exploits available for this hole I hope Microsoft considers making hotfixes available in the future if the active exploits cause more damage than would be caused by a poorly tested patch. At some point Microsoft needs to let the network owner establish their own risk tollerance.

-Vlad

re: You should already know about this...

tonysoper_MSFT — Fri, 06 Jan 2006 19:54:03 GMT

Just for the record, I disagree with Vlad's assertion "This was not a wildly dangerous exploit to begin with..."
The vulnerability is rated critical
The exploit was zero-day
It doesn't get more dangerous than that in the risk-management rubric most folks use.

re: You should already know about this...

Kevin Remde — Fri, 06 Jan 2006 17:09:38 GMT

Hi Vlad. Thanks for commenting... and you make some strong arguments.

Really, though; going back to my point about sufficient testing... Realize that the Security powers-that-be understood how much damage was being done or what the potential for damage was. But I highly recommend that you read Mike Nash's post on the MSRC blog; specifically point #3 in his 3 "things we know for sure" list. "The only thing worse than having to deploy an update is having to deploy that same update twice because of a quality problem with the update." How much more damage could be caused if some common, critical business application or functionality were lost temporarily because the patch screwed something up? As I've said - I've seen it happen. Several years ago there was the uproar when a Microsoft update completely screwed up how the company I was managing IT for lost the ability to use Terminal Services. Ouch. The cure was worse than the disease! I was happy to read that a big reason we were able to release it early at all was due to some amazing, heroic efforts on the part of the quality assurance / test folks who were able to sign off on this earlier than anticipated.

Here's the MSRC blog address (for those of you who didn't see my other post on this subject):
http://blogs.technet.com/msrc

-Kevin

re: You should already know about this...

Vlad Mazek — Fri, 06 Jan 2006 06:42:20 GMT

Kevin,

If you don't want to read an extended explanation: Yes, Microsoft should have released this patch prior to completing full regression testing, provided that is came with a warning as do all of the Microsoft hotfixes.

Now on to the extended commentary:
Software vendors should not dictate the security policy of their clients, especially when those clients have paid for software and support. This was not a wildly dangerous exploit to begin with, but I hope it sets a precedent for future security policies at Microsoft. If we have an immediate danger that cannot be eliminated through the use of antivirus, firewalls, stateful packet filtering, and user education should we still sit in the water while Microsoft defines our risk tollerance?

I for one hope not. Microsoft must understand that Microsoft clients need to be able to respond in a timely manner and must have the ability to assess their own risk tollerance, especially if an untested patch is available. I can only offer myself as an example. I manage around 4,000 servers with 23 GigE connections to the Internet. If I had no way to protect a network with that much horse-power and bandwidth would Microsoft share the part of the bill when a serious, unpatchable security exploit was used to create tactical strikes taking down major ecommerce sites world-wide?

Large scale example, but I hope these matters are considered seriously now before we see them on CNN.

Sincerely,

Vlad Mazek
MCSE 2003, Exchange MVP
http://www.vladville.com