Fergie's Tech Blog

Another Black Eye for Microsoft Patch Creation Process

Ryan Naraine writes in eWeek:

A private security research firm has published an advisory with details on a fundamental mistake made by Microsoft Corp. that caused a security patch to ship without an adequate fix for the flaw it was meant to address.

Cesar Cerrudo, founder and CEO of Argeniss Information Security, found that the inadequate fix was included in the MS05-018 bulletin that shipped on April 12, leading to a situation where a new patch had to be created to provide comprehensive protection.

Cerrudo, a well-known researcher who specializes in application security, published technical details, here in PDF form, to explain how the original patch missed several attack vectors.

The original patch was meant to address a denial-of-service flaw on CSRSS (Client/Server Runtime Server Subsystem), the user-mode part of the Win32 subsystem.

However, when Cerrudo reverse engineered the bug to build an exploit, he found that that the vulnerability could still be exploited.

posted by Fergie @ 10/28/2005 03:14:00 PM