One related question: Although a patch was available, buffer overflows have been a known problem for over 2 decades. It's like "We provided a fix for the bridge which you didn't deploy, but built it wrong in the first place", the engineering firm would still probably be sued into the ground for gross negligence.

Stack overflows are not only a known old problem, but easy to solve: Both Stackguard and Microsoft's "We invented it first 3 years later" reinvention should have stopped this attack cold.

At this point, do we get into "Known or should have known" negligence/malpractice on the part of Microsoft and their developers?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/141/18068#18068