Analytics
11/16/2009
10:00 AM
Connect Directly
RSS
E-Mail
50%
50%

Does New Microsoft Patent Infringe On Unix Program Sudo?

Some in the open source community suspicious of Microsoft's intent

A patent granted to Microsoft (NSDQ: MSFT) has stirred up worry that world's largest software company wants to claim Unix's "sudo" as its own.

Sudo is a Unix program used to raise a user's privilege level to accomplish tasks that require administrative privileges. It allows a user to temporarily execute commands as the root user.

Microsoft's "Rights elevator" patent describes a way to "enable a user to elevate his or her rights," which of course is what "sudo" does.

This apparent similarity has led some in the open source community, cognizant of Microsoft's past hostility toward open source software, to ask whether the company plans to demand a patent licensing fee from open source vendors.

Microsoft may wish it could do so. If so, it won't say: The company declined to comment.

In any event, the "Rights elevator" patent isn't likely to provide Microsoft with the opportunity to seek such fees.

Michael B. Einschlag, a partner at Rosenlaw & Einschlag, which specializes in open source and intellectual property law, said Microsoft's "Right elevator" patent is narrowly framed to cover the graphic user interface used to present computer privilege elevation.

"It's a description of how to present the information to the user," he said. "It doesn't cover the concept of how the user is trying to accomplish some task."

After reviewing documents covering the patent's history, Einschlag pointed to three specific identifiers that the patent's examiner concluded were necessary for Microsoft's invention to qualify as a patentable innovation: frequency of use; association with the current user; and indication of sufficient but not unlimited rights.

"Fundamentally, it's something to make it easy for users to understand how to upgrade their rights," he said.

In short, suspicions about this patent are overblown.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3090
Published: 2014-09-23
IBM Rational ClearCase 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3101
Published: 2014-09-23
The login form in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not insert a delay after a failed authentication attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

CVE-2014-3103
Published: 2014-09-23
The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2014-3104
Published: 2014-09-23
IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3105
Published: 2014-09-23
The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account n...

Best of the Web
Dark Reading Radio