Microsoft to Tell Vendors about Vulnerabilities Sooner

Network World — Microsoft yesterday said it’s changing its software vulnerability-notification program, which makes public any Microsoft-related vulnerabilities on the second Tuesday of each month, by giving selected commercial vendors special access to vulnerability information in advance of the general public.

Commercial vendors of security and protection software allowed to join the Microsoft Active Protections Program (MAPP) will receive information and code fixes that will help them prepare their software-remediation tools to be ready as the notice of Microsoft-related vulnerabilities is made public. Microsoft says it’s making the change to go on the offensive against hackers who are releasing exploits within hours of Microsoft vulnerabilities being publically disclosed.

“Malware authors are starting to take advantage of it as a well,” said Steve Adegbite, senior program manager lead at Microsoft about Microsoft’s once-a-month security advisories.

By way of example he pointed out that this April, malware authors took just two hours to post an exploit for a vulnerability cited in security advisory MS08-025. That type of speed among hackers is a growing trend, he said, and to counter it, the MAPP effort, which will start in October, will provide select commercial security and protection software vendors with information in advance so they can have their tools updated and ready at the moment of a public vulnerability announcement.

The vendors will have to have “a significant Microsoft customer base” to participate in the program, he noted, and be willing to keep information and code fixes provided by Microsoft under nondisclosure agreement.

“We’re giving you the piece of code that caused the vulnerability, such as an unchecked buffer length,” he said.

In a related effort that will also start in October, Microsoft will introduce an “Exploitability Index” intended to help customers prioritize their updates and give guidance on the likelihood of functional exploits. It’s expected that this Index will not remain static but will receive updated information as knowledge about exploits becomes available.

In a third but separate effort, Microsoft’s vulnerability research division will be starting to identity vulnerabilities in Windows-based third-party software products. “We’ll start with third-party vendors with the broadest impact to our customers,” says Microsoft security strategist Katie Moussouris. She says Microsoft is often contacted by researchers who think a software problem is Microsoft-related when it turns out to be a third-party product, like a plug-in. Microsoft will be examining third-party products with an eye toward identifying vulnerabilities and work with other vendors on their fixes.