Gartner Questions Microsoft's Commitment To Operating-System Security - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Gartner Questions Microsoft's Commitment To Operating-System Security

The research firm warns that the ASN.1 vulnerability made public this week could prove worse than the vulnerability that made MS Blaster possible.

Research firm Gartner issued a note late Thursday that raises serious questions about Microsoft's internal commitment to rid its operating system of security holes that make worms such as MS Blaster, SQL Slammer, and Code Red possible.

The report from Gartner was spurred by the Abstract Syntax Notation vulnerability which Microsoft made public and issued a corrective patch for earlier this week. The vulnerability affects most every modern version of the Windows operating system and most security experts agree systems that aren't quickly patched are at high risk of hacker attacks or a quick-spreading Internet worm.

"This smells like Blaster all over again," says John Pescatore, a research director at Gartner and one of the authors of the report. But Pescatore warns that this vulnerability could prove worse than the vulnerability that made MS Blaster possible. Blaster created havoc for system operators in August 2003, the same week as the major blackout that left many in the Northeast without power. The ASN.1 vulnerability can be accessed through port 80, as well as other ports widely used to communicate over the Internet.

Pescatore says April marks the one year ship date for Windows Server 2003 and he had hoped Microsoft's internal push to improve the security of its applications would have caught these types of flaws. He said it was troublesome that these types of flaws have been uncovered by external security researchers and not by Microsoft.

Eeye Digital Security was the company that found the ASN.1 vulnerability and reported it to Microsoft in July of last year. The vulnerability that MS Blaster attacked, which was within Microsoft's Distributed Component Object Model (DCOM) Remote Procedure Call interface, was discovered by The Last Stage of Delirium Research Group.

The ASN.1 vulnerability exists in versions of Windows prior to Windows 2003 Server, including Windows NT and 2000. "These old bugs being found in Windows 2003 are more worrisome than if only new bugs that only affected Windows 2003 were found," says Pescatore. "It means they've not been doing enough to find these holes on their own."

Gartner had previously recommended to its clients that they delay deployment of Windows 2003 Server in "sensitive Internet-exposed applications" until sometime after the second half of this year, but the note published Thursday indicated the firm may change its recommendation.

"We may have to revise even this cautious position if Microsoft fails to commit publicly to extraordinary efforts to eliminate glaring holes in its operating systems. Enterprises should continue to heavily weight the cost of continually patching Microsoft products when deciding which operating system to purchase," the report stated.

Gartner recommends companies immediately:

  • Install the Microsoft patch on all PCs and servers;
  • Block vulnerable ports as they are identified;
  • Configure enterprise firewalls correctly to limit exposure; and
  • Install personal firewalls on all PCs and intrusion-prevention software on all business-critical Windows servers.
  • In a statement E-mailed to InformationWeek, Microsoft said that it never expected to perfect security overnight, but it continues to believe that Window Server 2003 demonstrates significant progress.

    We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
    Comment  | 
    Print  | 
    More Insights
    The State of Cloud Computing - Fall 2020
    The State of Cloud Computing - Fall 2020
    Download this report to compare how cloud usage and spending patterns have changed in 2020, and how respondents think they'll evolve over the next two years.
    Top 10 Data and Analytics Trends for 2021
    Jessica Davis, Senior Editor, Enterprise Apps,  11/13/2020
    Where Cloud Spending Might Grow in 2021 and Post-Pandemic
    Joao-Pierre S. Ruth, Senior Writer,  11/19/2020
    The Ever-Expanding List of C-Level Technology Positions
    Cynthia Harvey, Freelance Journalist, InformationWeek,  11/10/2020
    Register for InformationWeek Newsletters
    Current Issue
    Why Chatbots Are So Popular Right Now
    In this IT Trend Report, you will learn more about why chatbots are gaining traction within businesses, particularly while a pandemic is impacting the world.
    White Papers
    Twitter Feed
    Sponsored Live Streaming Video
    Everything You've Been Told About Mobility Is Wrong
    Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
    Sponsored Video
    Flash Poll