Tavis Ormandy bashes Microsoft's handling of security researchers, drops Windows zero-day
A Google security engineer accused Microsoft of treating outside researchers with "great hostility" just days before posting details of an unpatched vulnerability in Windows that could be used to crash PCs or gain additional access rights.
Microsoft acknowledged the vulnerability late Tuesday. "We are aware of claims regarding a potential issue affecting Microsoft Windows and are investigating," said Dustin Childs, a spokesman for the company's security response group, in an email. "We will take the appropriate action to protect our customers."
Childs declined to answer additional questions, including whether Microsoft had been aware of the vulnerability before it surfaced on the Full Disclosure security mailing list May 17, or when it would release a patch. Tavis Ormandy, a Google security engineer, revealed the bug on Full Disclosure, where he discussed the flaw in the Windows kernel driver, "Win32k.sys," and asked for help in overcoming a roadblock. "I don't have much free time to work on silly Microsoft code, so I'm looking for ideas on how to fix the final obstacle for exploitation," he wrote.
