Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Is it appropriate for a software developer to provide zero day vulnerability corrections as at-user-discretion installers to apply patches or is it preferred to force it in cyclic updates?

The reason I ask is particularly in response to seeing this: http://arstechnica.com/security/2012/09/critical-zero-day-bug-in-microsoft-internet-explorer/

In this case Microsoft chose to provide a fix-it solution rather than Windows updates. Perhaps they plan to provide it as an update, but I didn't see that.

share|improve this question
This exploit will be patched. In the mean time it doesn't mean a workaround can be implemented to stop future systems from being compromised. That particular article is not very clear about it, I blame the author, for having a clear and underline hatered for Microsoft. – Ramhound Sep 19 '12 at 15:27
1  
Agree with Ramhound here. After digging into some of the other articles by the same author, as well as his Twitter feed, it's pretty obvious he's got a bit of a grudge against Microsoft. – Polynomial Sep 19 '12 at 15:46
So this is merely a first step approach with plan to roll into a long term forced fix. I haven't seen this done before this way is why I was alerted. – Sn3akyP3t3 Sep 19 '12 at 15:52
Patches aren't the only way to mitigate software flaw vulnerabilities. Network defense (firewalls, IPS), host hardening, application virtualisation, and other good security practices can protect against general and specific vulnerabilities. – adric Sep 19 '12 at 23:24

1 Answer

up vote 2 down vote accepted

Often this is done because the fix used might have an impact on functionality. Remember they acted quickly so it might be that some functions are broken. If they would push it in their updates, it might result in a lot of users being unhappy because their webapplication is broken or doesn't work properly. So that's why they leave the choice at the moment.

I believe that once it has been tested properly, it will be pushed into the patch tuesday cycle.

share|improve this answer
+1 on this. Microsoft have a rigorous testing cycle, but some bugs are nasty enough to warrant a patch being released with only minimal testing completed. The patch EULA seems to reflect this, too - they're claiming zero liability for damages. – Polynomial Sep 19 '12 at 15:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.