Risk
4/21/2011
05:12 PM
Connect Directly
RSS
E-Mail
50%
50%

Microsoft Updates Vulnerability Disclosure Policies

The software company clarifies its vulnerability-handling guidelines and begins issuing security bulletins for third-party products.

Strategic Security Survey: Global Threat, Local Pain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
Microsoft wants to sell you on coordinated vulnerability disclosures.

The company released new vulnerability disclosure policies on Tuesday. In particular, Microsoft updated its coordinated vulnerability disclosure (CVD) document, which details how it works with vulnerability researchers. The document was first introduced in July 2010.

"The new CVD procedures delineate very carefully what all parties can expect from Microsoft in the vulnerability disclosure process," said Andrew Storms, director of security operations for nCircle, in an email interview. "It's the first time a vendor has defined the various roles in a vulnerability disclosure and management process and created a set of deliverables for each role."

In addition, Microsoft has revised its staff guidelines. While employees were formerly encouraged to report any vulnerabilities they find in external products to the company's Microsoft Security Resource Center (MSRC), it's now mandatory. "We've also made sure that there's a team that can help them, and that's the Microsoft Vulnerability Research team"--aka MSVR--said Mike Reavey, director of the MSRC, in an interview. MSVR is the group at Microsoft that, as detailed in the CVD, works with external security researchers who report vulnerabilities to Microsoft.

For the first time, Microsoft has also begun to release public advisories for third-party products, and when possible coordinating the release of that information after the vendor has crafted a fix. On Tuesday, the company detailed one bug affecting Google Chrome and Opera, and another that just affected Chrome. Both have been patched.

All of these moves by Microsoft are aimed at bolstering uptake of coordinated vulnerability disclosures, in which vulnerability researchers share information about bugs they've discovered with the relevant vendor, then wait to disclose the vulnerability publicly until a patch has been released. This approach was formerly dubbed "responsible disclosure," but Microsoft gave it a makeover. "The main reason for that shift was because the word 'responsible' evoked a lot of emotional responses for people," said Reavey.

As that suggests, there's some debate amongst vulnerability researchers about the best way to disclose vulnerabilities. Proponents of rapid disclosure--aka not waiting for vendors--often claim that it leads to bugs being fixed more quickly. They also note that if they've found it, attackers may already have found and been exploiting the vulnerability too. According to Microsoft, however, "drawing upon our years of experience, we have seen that disclosing vulnerability details and/or exploits before a vendor has a chance to address the issue amplifies the risk of attacks."

Interestingly, while Microsoft's new CVD commits the organization to the path of coordinated disclosures, Microsoft said it will publicly detail vulnerabilities in cases where the vendor is unresponsive and related attacks are already underway.

But one component lacking from Microsoft's revised CVD, said some security experts, is a concrete timeframe for fixes.

Another criticism, at least historically, has been the difficulty of connecting with Microsoft vulnerability remediation staff. But security experts said that Microsoft has been improving. "For the past two years or so, I've seen a great improvement in the way Microsoft handles vulnerabilities. Still, sometimes the time to fix is high, since there are too many bug reports and it is very hard to prioritize," said Rodrigo Branco, vulnerability and malware research director at Qualys, in an email interview.

Another route for making contact with Microsoft, furthermore, is through a computer emergency readiness team (CERT), said Branco. He said this is an excellent approach--in general--if a vulnerability researcher is having difficult getting "their vulnerabilities accepted by vendors, especially if both researcher and vendor have had little prior exposure to the process." Using a third party such as a CERT helps both with notification and influencing a vendor to tackle the problem.

Overall, many security experts said Microsoft is doing a relatively good job of improving the security of its products, both through secure software development practices, as well as mitigating bugs in its products relatively quickly. "If you take into consideration that Microsoft doesn't pay for bugs like Google Chrome, then from my viewpoint, it looks like they are doing a pretty good job," said nCircle's Storms.

He also recommends that security executives take a cue from how Microsoft has detailed its security vulnerability policies, to likewise set their own "clear expectations and enforceable guidelines" for their company's employees should disclose bugs.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.