Microsoft changes tune, may patch IE7 bug

There was no fix for the protocol-handling flaw this week, but probe continues

Although Microsoft fixed four flaws in Internet Explorer (IE) this week, it did not address a protocol-handling problem that could trick users into downloading malware, a move that surprised at least one security researcher. The company, however, said it has reopened its investigation and may provide a patch in the future.

"I was prepared to talk about a patch yesterday," said Andrew Storms, director of security operations at nCircle Network Security. "I expected to see Microsoft retract its prior stance and fix this."

Storms was referring to the position that Microsoft first staked out in July -- that Windows and IE are not to blame for the protocol-handling vulnerabilities cited by multiple researchers. This week, the blame game returned when Juergen Schmidt of Heiese Security said IE 7 passed invalid Uniform Resource Identifiers (URI) to Windows XP, a bug that attackers could exploit to launch malicious code or scripts if users simply clicked on a link.

When Schmidt asked Microsoft if it intended to patch IE 7, he said he received an answer identical to comments the company made last summer: "After its thorough investigation, Microsoft has revealed that this is not a vulnerability in a Microsoft product."

Researchers, including nCircle's Storms, disagree. "I still believe they have to do something," he said. "Every application should do its own part to provide security."

In fact, Microsoft may be rethinking the situation. When Computerworld asked the company for comment on Schmidt's claims, it indicated it had reopened its examination. A spokesman said: "Microsoft is aware of reports of a potential issue in the way that Windows handles URLs passed in from other applications. Microsoft is continuing its investigation into this issue. Once we're done investigating, we will take appropriate action to help protect customers. This may include providing an update or additional guidance for customers."

Previously, Microsoft had stated several times that its engineers had concluded that the vulnerability was in third-party applications, and therefore, not its responsibility.

To complicate matters, Thomas Kristensen, the chief technology officer for Danish vulnerability tracker Secunia, said he reported a protocol-handling vulnerability in Outlook Express 6 and Outlook 2000 to Microsoft earlier this week. The two e-mail programs can be exploited if users are duped into clicking specially-crafted, spoofed links within VCards, the electronic business card file format used to exchange contact information. Microsoft patched Outlook Express 6, but the fix was for a different bug.

"Microsoft is now affected by their own design," Kristensen said in an e-mail. "We hope that Microsoft now chooses the right path and creates a general fix for Windows and IE 7 rather than start patching all their own applications and ask third-party vendors to do the same."

Other security researchers aren't as optimistic that Microsoft will make a 180-degree turn. "I kind of think they're saying they still really think it's someone else's problem, but if enough people yell at them, they'll do some fixing, too," Roger Thompson, chief technology officer at Exploit Prevention Labs, said when asked to comment on Microsoft's latest response.

Thompson, for one, was also less concerned with the debate over responsibility. "No one is using this in the wild, as far as we can see. That's the whole thing, the stuff that really counts is what gets used, not what might happen."

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?