Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


09:30 AM
Connect Directly

The Perils of Third-Party Patches

Some organizations issue security patches faster than your vendor, but experts claim benefits aren't worth the risk

Nothing in life is truly free -- and that goes for those free, third-party software patches.

Patches for recent Microsoft vulnerabilities from the Zeroday Emergency Response Team (ZERT) and Determina have added yet another dimension to the question of patch management: Should you wait for the vendor's patch, or take the freebie as a stopgap? (See ZERT Issues 'Stopgap' IE Patch.)

ZERT beat Microsoft to the punch with a free patch for the fast-spreading Internet Explorer VML bug last week, and Determina issued a free patch for the WebViewFolderIcon setSlice bug in Windows. (See Zero-Day: Won't Go Away.) But Microsoft and other vendors typically don't approve of, or endorse, third-party patches to their products.

Both ZERT and Determina are reputable sources. But in general, security experts say, third-party software patches pose a big risk for enterprises. Some purported "patches" can contain malware, and even a patch from a trusted third-party could inadvertently crash your system and add to your patch management migraine.

"I would not recommend getting yet another vendor involved. That just adds further complexity, expense, and maintenance to the equation," says Sean Kelly, business technology consultant with Consilium1.

If you do go with a third-party patch, remember that it isn't supported by Microsoft if something goes wrong -- although Microsoft will probably get stuck fielding the help desk calls. "You have to be willing to say that the security risk is such that it's [worth] the risk of crashing some computers," says Randy Abrams, director of technical education for ESET and the former operations manager for Microsoft's GIAIS.

ZERT even cautioned users to deploy its patch at their own risk since its VML patch wasn't tested by Microsoft. And so far, third-party patches haven't really been very popular among enterprises, anyway: At last count, there were just over 15,000 downloads of the Zert VML patch, says Eset's Abrams, who works with a group of researchers from which ZERT was formed.

So far, few enterprises are considering third-party patches as a stopgap for the real thing, either. They figure it's less risky to wait unpatched for Microsoft's Patch Tuesday than to create any unwanted problems.

"Honestly, I've never considered using a third-party patch," says Joseph Foran, director of information technology for FSW. "I don't know if doing so would void any service agreements, or if it might break something deeper -- especially in Windows and other closed-source OS kernels -- down the line or how it would react to the vendor patch being applied on top, or even if patching tools like Microsoft's WSUS would pick it up properly."

Jay Wessel, vice president of technology for the Boston Celtics, says he waits for Microsoft's patches: "That's risky enough," he says. "[And] every once in a while, if a vendor has a specific issue and they can point me to a specific patch or fix, I consider that acceptable."

There's just no substitute for the actual vendor's ability to fully test out a patch before issuing it, however. Microsoft, for instance, put in 10,000 hours of testing -- in parallel among multiple machines -- on its Windows MetaFile (WMF) patch, Eset's Abrams says. "Microsoft has the infrastructure for testing that small groups" don't have.

Microsoft is due to release its monthly patches next Tuesday, October 10. A patch for the VML bug is expected to be among the security bulletins.

But before enterprises get too sanguine, recent experience shows that even Microsoft and McAfee can issue patches that aren't always failsafe. (See Microsoft Patches Its Patches.)

There are times when a third-party patch may make sense, like if a company finds itself the victim of a targeted attack that uses a bug that hasn't yet been patched by the vendor, according to Mark Shavlik, president of Shavlik Technologies. "Most of these problems have some sort of workaround if you're willing to do the work," though.

Still, the window of these patches is typically small, anyway, he says, so it wouldn't be in place for too long. "By the time you roll it out, the vendor may already have its patch out."

Third-party patches could fly if big patch management companies like PatchLink and BindView assimilate them into their products, says David Aitel, president of Immunity. That would help enterprises manage the patches, and use them. "Then they could deploy them via automated systems."

So what's driving the rise in third-party patches lately, anyway? In some cases, a little marketing PR, security experts say, as well as concerned researchers who want to get a patch out quickly.

"ZERT wasn't about 'let's get it out faster than Microsoft,'" Abrams says. "It was about people who worked behind the scenes on the Internet backbone, who test malicious software, saying 'this thing could spread fast and would make my job harder if it does.'"

Their target, Abrams says, was organizations who couldn't use Microsoft's workaround of unregistering the DLL.

Meantime, freebie third-party patches are more of an anomaly for the typical business, although that could change. "Today, no one's going to do it," Immunity's Aitel says. "But times are changing. Microsoft is not exactly winning the hearts and minds with their patching systems" and process.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • Microsoft Corp. (Nasdaq: MSFT)
  • Determina Inc.
  • ESET
  • Shavlik Technologies
  • Immunity Inc. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 8/10/2020
    Researcher Finds New Office Macro Attacks for MacOS
    Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
    Hacking It as a CISO: Advice for Security Leadership
    Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
    Register for Dark Reading Newsletters
    White Papers
    Cartoon Contest
    Current Issue
    Special Report: Computing's New Normal, a Dark Reading Perspective
    This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
    Flash Poll
    The Changing Face of Threat Intelligence
    The Changing Face of Threat Intelligence
    This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    PUBLISHED: 2020-08-13
    Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
    PUBLISHED: 2020-08-13
    Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
    PUBLISHED: 2020-08-13
    Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
    PUBLISHED: 2020-08-13
    Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.
    PUBLISHED: 2020-08-13
    Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version may allow an authenticated user to potentially enable denial of service via local access.