dbd

Microsoft knew of critical IE flaw used in Google attack 5 months ago (Download Squad)

Jan 22nd 2010 1:25PM I can tell by downloadsquad.com posts that you guys do not like Microsoft.

"When the vulnerability was disclosed to Microsoft in last December, there wasn't any known exploit in the wild," Chenxi Wang, Principal Analyst of Security and Risk Management at Forrester Research, told Ars. "Hence Microsoft scheduled to release the patch in February, which was the next available security bulletin date. But this attack came up before they released the update. That's why they issued the out of band fix. To be fair, Microsoft sees a lot of vulnerabilities, and you don't know which one actually would result in an attack."

In short, Microsoft did what it always does: work on a fix, but don't tell the public until it is absolutely necessary to warn them, and then release it as soon as possible.