[ insider_reports_insider ]
Microsoft Admits Ignoring Jet Flaw
David Utter
Staff Writer
2008-03-25
 Insider Reports RSS Feed
Security engineers at Microsoft ignored addressing this latest exploit for years, as they believed existing protections mitigated the threat.
 | | Microsoft Admits Ignoring Jet Flaw |  |
Microsoft admitted to knowing about the vulnerability present in the Jet Database Engine since March 2005. The flaw received attention recently as new exploits targeting it began circulating the Internet last week.
In an update at the Microsoft Security Resource Center blog, Mike Reavey owned up to Microsoft's inaction about the problem over the past three years:
These new attacks, discussed in Friday's security advisory, use the exact same vulnerability as was posted in a November 2007 full-disclosure posting by cocoruder. In fact, very little was changed about the file compared to cocoruder's POC file which launched calc.exe. It uses the same column number overflow.
Even as far back as March 2005, HexView posted a similar vulnerability in msjet40.dll column handling. You'll notice that both the HexView and the cocoruder posting mention that they first submitted their samples to the MSRC, but the MSRC replied back that they would not address the issues via a security bulletin because any attempt to attack customers using these issues was heavily mitigated by the blocking mentioned earlier in this post.
Reavey noted how Outlook, Exchange, and Internet Explorer regularly block or warn about .mdb files coming into a PC. However, the latest attacks deliver the malicious .mdb payload via opening a Word document.
Windows Server 2003 and Windows Vista are not vulnerable as they contain a newer version of the vulnerable msjet40.dll that lacks the flaw being exploited. The best protection now, pending a broader release of the updated msjet40.dll, will be to avoid opening unexpected attachments in email.
View All Articles by David Utter
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
