Analytics
11/16/2009
10:00 AM
50%
50%

Does New Microsoft Patent Infringe On Unix Program Sudo?

Some in the open source community suspicious of Microsoft's intent

A patent granted to Microsoft (NSDQ: MSFT) has stirred up worry that world's largest software company wants to claim Unix's "sudo" as its own.

Sudo is a Unix program used to raise a user's privilege level to accomplish tasks that require administrative privileges. It allows a user to temporarily execute commands as the root user.

Microsoft's "Rights elevator" patent describes a way to "enable a user to elevate his or her rights," which of course is what "sudo" does.

This apparent similarity has led some in the open source community, cognizant of Microsoft's past hostility toward open source software, to ask whether the company plans to demand a patent licensing fee from open source vendors.

Microsoft may wish it could do so. If so, it won't say: The company declined to comment.

In any event, the "Rights elevator" patent isn't likely to provide Microsoft with the opportunity to seek such fees.

Michael B. Einschlag, a partner at Rosenlaw & Einschlag, which specializes in open source and intellectual property law, said Microsoft's "Right elevator" patent is narrowly framed to cover the graphic user interface used to present computer privilege elevation.

"It's a description of how to present the information to the user," he said. "It doesn't cover the concept of how the user is trying to accomplish some task."

After reviewing documents covering the patent's history, Einschlag pointed to three specific identifiers that the patent's examiner concluded were necessary for Microsoft's invention to qualify as a patentable innovation: frequency of use; association with the current user; and indication of sufficient but not unlimited rights.

"Fundamentally, it's something to make it easy for users to understand how to upgrade their rights," he said.

In short, suspicions about this patent are overblown.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0543
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2015-0544
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.

CVE-2015-2721
Published: 2015-07-05
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attacke...

CVE-2015-2722
Published: 2015-07-05
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker.

CVE-2015-2724
Published: 2015-07-05
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code v...

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report