, SecurityFocus 2006-01-12
For four days in January, network administrators and security-savvy home users had a choice: Download and install an unofficial open-source fix for the critical flaw in the Windows Meta File (WMF) format or wait an estimated week for an official patch from Microsoft.
With security experts warning about the spread of exploits for the flaw in Microsoft's Windows operating system, tens of thousands of people downloaded the patch from the Web site of security software developer Ilfak Guilfanov and other Web sites that hosted the file, according to numbers provided to SecurityFocus.
The quick release of the patch showed the power of community-created code, but also the pitfalls. While source code accompanied the patch and Guilfanov made it easy to uninstall, the decision to install the patch came down to a single question: Did the user trust the software developer, Ilfak Guilfanov?
"The patch was caveat emptor--let the patcher beware," said Richard Ford, associate professor of computer science at the Florida Institute of Technology. "Users are not sophisticated. It is hard for them to tell the difference between a genuine third-party patch developed by a white hat, and a program created by a black hat that looks like a patch."
A day later, several security groups vouched that the patch did what Guilfanov said it did, reducing the risk of an untrustworthy patch. Yet, even the patch's creator recognized the inherent problems in the situation. Having to make a decision about whether to trust a third-party patch should not be necessary in order to protect systems.
"As a general rule, (third-party patches) should not be applied," Guilfanov said. "The current situation was, in my perception, a bit different. First there was the danger, then I saw a relatively simple and clean, risk-free fix. ... If I could help my knowledgeable audience - who could do their own testing, why not? People are postings exploits all the time, why not post a solution for a change?"
The unofficial patch debate underscored the problems with relying on software fixes to secure systems. While Microsoft released its official patch for the problem last Thursday, five days early, attackers had already started using the vulnerabilities in the Windows Meta File (WMF) format putting the vast majority of users at risk. The situation emphasized the fact that neither Microsoft's patches nor community-created fixes will ever be able to defeat the threat of a zero-day attack.
"Speeding up the patch process is never going to solve the problem, it is never going to be fast enough," the Florida Institute of Technology's Ford said. "We need to be investing very heavily in zero-day defenses, because another zero-day will happen. There is a lot of talk about whether (the software vendor has) gotten the patch out in time, but the real conversation should be about risk removal, not risk mitigation."