Microsoft patch opens users to attack
Robert Lemos, SecurityFocus 2006-08-22 — UPDATE: Microsoft continued to work on a fix on Tuesday for an exploitable flaw introduced by the company's latest security update to Internet Explorer. — The flaw, initially thought to only crash Internet Explorer …
Context & Ripple Effects
Robert Lemos reports that the flaw in Microsoft's latest Internet Explorer security update, initially assessed as merely crash-prone, turns out to be exploitable — meaning the patch itself widened the attack surface it was meant to shrink. As of Tuesday, Microsoft was still working on the corrective fix, leaving patched machines exposed in the interim.
The timing compounds an awkward stretch for the company: within days of this report, Microsoft had also confirmed a $16 billion boost to its share repurchase program and extended an invitation to the Firefox development team to collaborate at its Open Source Software Lab in Redmond — a courtship of its chief browser rival just as its own browser's update process came under question.
First-order effects
- Enterprises and consumers who applied Microsoft's Internet Explorer update now run patched systems carrying a known exploitable flaw, forcing a choice between uninstalling the update and waiting for Microsoft's follow-up fix.
Second-order effects
- The misstep strengthens Firefox's hand as the alternative browser precisely when Microsoft is courting Mozilla's developers in Redmond, turning update reliability into a competitive differentiator.
Third-order effects
- If vendor patches keep introducing vulnerabilities, Patch Tuesday shifts from routine hygiene to a calculated risk, pushing enterprises toward staged deployment and testing before updates reach production machines.
The trend: Security updates are emerging as an attack vector in their own right, pressuring vendors toward out-of-band fixes and enterprises toward treating every patch as untrusted code until proven otherwise.