Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Speaking to Computer World, Swa Frantzen, an analyst at SANS Institute's Internet Storm Center, criticised Microsoft for issuing patches that fix the Windows versions of PowerPoint while announcing that patches for the same flaws in the Mac editions would not be released until June.
He claimed that revealing this information would allow a hacker to hijack computers before a patch is available. Microsoft revealed that Office for Mac 2004 and Office for Mac 2008 contain three unpatched vulnerabilities and the combination could be used by hackers to craft exploits targeting Macs.
An online poll on the ISC site showed that 47 per cent agreed Microsoft had been irresponsible in omitting patches for the Mac. Frantzen said: “Microsoft is the one big company screaming loudest of all over ‘responsible disclosure'. “They want an unlimited amount of time to release their patches before those who found the problem are allowed to publish (but they can publish the second after Microsoft released the patch, all is fine for Microsoft, well, for their customer it's a bit of a different matter of course). “Of course attackers couldn't care less about disclosure, and even some vulnerability researchers don't care for the credit line that Microsoft offers, nor the brand ‘irresponsible' it might earn them. Still a policy typically cuts both ways: you need to obey the rules yourself just as well as demand it from all others involved.” See original article on scmagazineuk.com
“They want an unlimited amount of time to release their patches before those who found the problem are allowed to publish (but they can publish the second after Microsoft released the patch, all is fine for Microsoft, well, for their customer it's a bit of a different matter of course).
“Of course attackers couldn't care less about disclosure, and even some vulnerability researchers don't care for the credit line that Microsoft offers, nor the brand ‘irresponsible' it might earn them. Still a policy typically cuts both ways: you need to obey the rules yourself just as well as demand it from all others involved.”
See original article on scmagazineuk.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.