Who can you trust when it comes to bug reporting these days? Not every firm that calls itself a security researcher. Researchers need to balance working with a vendor (particularly Microsoft) and performing the whistle-blowing function. But researchers get eager to make names for themselves and they sometimes want to skip the contact-the-vendor part and go straight to the get-credit-for-finding-a-bug part. A case in point is the war of words Microsoft engaged in this week over a bug found in Windows Media Player. The bug was announced late Christmas eve on the SecurityFocus’s Bugtraq site. Yesterday Microsoft said the claims made by the researcher are flat-out not true. The site reportedly claimed that a bug in Windows Media Player 9, 10 or 11 on Windows XP or Vista allowed remote code execution.
Microsoft says that there is indeed a bug that crashes Windows Media Player but that it doesn’t pose a security risk. Microsoft’s investigation showed that the application simply stalls. It can be restarted with no other effects on the system. Furthermore, Microsoft has taken the researcher to task for posting this information directly to the public, instead of contacting Microsoft and allowing its security folks to investigate first. The code might be faulty, but that hardly makes it a security risk.
If it is possible to feel sorry for Microsoft security folks, this aspect of the story ought to do it. As soon as they got wind of the bug report on Christmas Eve, they began investigating, working through the holiday to do so. Apparently they not only found that the faulty code was no big risk, but that it had already been fixed in Windows Server 2003 Service Pack 2.
Visit the Microsoft Subnet web site for more news, blogs, podcasts. Also see:
9 myths of Microsoft virtualization busted or confirmedTop 10 biggest stories in 2008 from Microsoft SubnetMicrosoft makes more promises for Windows 7 performance8 little-known technologies that instantly make Microsoft shops run smoother17 job-hunting resources for Windows pros Subscribe to all Microsoft Subnet bloggers.bi-weekly Microsoft newsletter. (Click on News/Microsoft News Alert.)Sign up for the
