.:Computer Defense:.

You know... I've written about this a lot... to recap:

• Agnitum provides "research" into Vista Firewall
• Company B is better than Company A, claims Company B
• A fine line between blogging and advertising

This time the culprit is Bill of BillP Studios and WinPatrol. WinPatrol is free malware software, but a paid version is also offered. With the introduction of Vista, which includes Windows Defender, WinPatrol is looking to become a tool of the past. I suppose I should add a disclaimer of sorts here that I regularly read Bill's blog and quite often agree with what he says... today just isn't one of those times.

So, in a recent post Bill addresses the dozen patches that Microsoft released this month... and he picks on in particular to target... MS07-010. Bill actually goes so far as to call it "one of the most important updates I’ve seen and one of the most embarrassing for Microsoft." This is beyond far fetched... He even compares it to the issue that Kryptonite had, where a pen could open their bike locks. This made me laugh since the flaw, while being most publicized against Kryptonite because of their popularity, affected several brands of bike locks which would mean that the flaw patched by MS07-010 affects many anti-malware products.

Bill also claims that users who have not yet patched are at immediate risk... I guess my definition of immediate risk varies from his. This was a privately reported vulnerability and there's nothing to indicate that it's in the wild... to me that implies lower risk than many things, including past Microsoft vulnerabilities. Now that the patch is out, I suppose malicious individuals could reverse the patch and determine how to take advantage of this vulnerability but the risk is still not "immediate" in my eyes.

Also, to put this out as being such an emergency, which is how I read it as being portrayed when I look at Bills post, is incorrect... Flaws are discovered all the time in AV and Anti Malware software... Does that make each of them more important, more embarassing and a bigger emergency than the last?

Let's take a look at this:

• Trend Micro Products UPX Processing Buffer Overflow Vulnerability
• Sophos Anti-Virus SIT/CPIO File Processing Vulnerabilities
• Sophos Anti-Virus Visio File Parsing Buffer Overflow
• McAfee Multiple Products LHA File Handling Buffer Overflow
• Symantec AntiVirus RAR Archive Decompression Buffer Overflow

I could go on, but this points out that every major AV vendor has had a processing problem in the past two years. Should the vendors get it right the first time? I'd hope so, but you have to allow for problems... it's something you have to accept if you're in IT. Processing a file type that isn't native to you or your product presents a learning curve and unless your company has experts on the file format they aren't necessarily going to get everything right the first time... or it could be a simple coding mistake and programmers are human you have to expect them..

To attack Microsoft over something that every vendor in the industry has had a problem with is juvenile... it also shows a lack of understanding that vulnerabilities can and will exist... Nobody is perfect.