The patch that could not wait for Tuesday

When a Windows image flaw was exploited in the wild, a monthly patch calendar met an attack that would not wait.

2 min readAI & Software
Line illustration in flat orange and blue on white: a hand reaches in from the right and presses a small square patch over the cracks in the glass of a framed picture.

A fixed release calendar exists to make change predictable for the people who have to absorb it. An active attack tests whether that predictability is still worth the wait.

A fixed release calendar exists to make change predictable for the people who have to absorb it. An active attack tests whether that predictability is still worth the wait.

What made the WMF flaw so urgent?

The danger sat inside ordinary pictures: the SANS Internet Storm Center explained that the WMF vulnerability used images to execute arbitrary code, and that it would execute just by viewing the image. Microsoft said it became aware on December 27, 2005 of public reports of attacks on customers exploiting a vulnerability in Windows. Microsoft Security Bulletin MS06-001, published January 5, 2006, carried a maximum severity rating of Critical and stated that the vulnerability was currently being exploited. The bulletin's advice was blunt: customers should apply the update immediately.

Why did the fix arrive ahead of schedule?

At first, Microsoft held to its rhythm: its stated goal was to release the update on Tuesday, January 10, 2006, as part of its monthly release of security bulletins. It said the update would be released worldwide simultaneously in 23 languages for all affected versions of Windows, and that its intelligence sources indicated the scope of the attacks was limited. In the gap, the SANS Internet Storm Center endorsed an unofficial patch made available by Ilfak Guilfanov for a while, then switched to recommending the official Microsoft patch. Microsoft then released the update earlier than planned, saying testing had been completed earlier than anticipated and citing strong customer sentiment that it should be made available as soon as possible. According to Microsoft, the fix was issued as MS06-001, and consumers who used Automatic Updates would receive the update automatically.

A release calendar is a service to the people who install updates, not a constraint on the people who write them. The schedule kept its value here because the exception was public, explained and tied to attacks already under way. The harder design question for any update system is not whether to break the schedule, but which conditions are allowed to break it, and whether that list is written down before the next malicious image arrives.

Sources

Tagged