Posted on Saturday, November 15 2008 @ 4:00 CET by Thomas De Maesschalck
A Microsoft security program manager explains why it took the software giant
seven years to fix a vulnerability. Apparently, they waited so long because fixing it would have broken customer network applications:
Christopher Budd, a security program manager in the Microsoft Security Response Center, said in a blog post Thursday that while Microsoft had been aware of the vulnerability, fixing it would have broken customer network applications.
"When this issue was first raised back in 2001, we said that we could not make changes to address this issue without negatively impacting network-based applications," wrote Budd. "And, to be clear, the impact would have been to render many (or nearly all) customers' network-based applications then inoperable."
Budd explained that, while Microsoft in 2001 advised customers to use SMB signing, it knew then that the mitigation might not be a usable solution for some.
"We did say that customers who were concerned about this issue could use SMB signing as an effective mitigation, but the reality was that there were similar constraints that made it unfeasible for customers to implement SMB signing," wrote Budd.
Source: CNET
