MS explains 7-year patch delay
Microsoft has explained why it took seven years to patch a known vulnerability. Fixing the bug earlier would have taken out network applications and potential exploits alike, it explained.
Security bulletin MS08-068 fixed a flaw in the SMB (Server Message Block) component of Windows, first demonstrated by Sir Dystic of Cult of the Dead Cow fame at a hacking conference in 2001, if not before. The flaw opened the door to SMB replay or reflection attacks that would have allowed the operator of a malicious SMB server to run exploits on vulnerable PCs.
The flaw was rated as important by Microsoft but critical by some independent security watchers, such as the SANS Institute's Internet Storm Centre. Microsoft explained the delay on issuing a patch on the effect a fix would have had on network-based applications. In a post on Microsoft's Security Response Blog, Christopher Budd explains that the SMBRElay attack worked in much the same way as its legacy NTLM protocol.
