Update: Ten New Security Holes in Windows XP SP2?

Ten new security holes in Windows XP Service Pack 2 have been discovered, so get ready to insert new patches into your patch management schedule. Microsoft recently announced their Security Bulletin Advance Notification Program, which gives administrators a several days advance notice of upcoming patches, however these new security holes were announced by security product maker Finjan Software.

Finjan said their Malicious Code Research Center discovered the new vulnerabilities, at least some of which are very dangerous. A spokesperson for the company said "Finjan has provided Microsoft with full technical details concerning the vulnerabilities [... ]and has been assisting Microsoft to patch these holes. In order to prevent the creation of malicious viruses and worms, Finjan will not release any
technical details about these vulnerabilities until they are fully patched by Microsoft."

Shlomo Touboul, CEO and Founder of Finjan Software, said "Windows XP SP2 operating system is a continuation of the same Windows XP Operating System and Windows Kernel. All Windows versions have been developed with requirements for highest backward compatibility and open architecture, with maximum productivity and ease of use. In addition, Windows applications typically run with administrative permission with full and unlimited access to computer resources."

 "This, together with the emerging technology of mobile code has created a situation in which active content travels freely over the web and gains full control of host computers. These fundamentals create a green field for hackers shown by constantly increasing attacks and damage over the last few years. A security patch of Windows operating system without changing the rules of the game will not be enough to fight the recent complex malicious code attacks such as Scob, Mydoom, and others. End users and Enterprises must add an independent security layer that is not dependent on the above fundamentals. Application level behavior blocking is the leading technology designed to immunize systems from both known and unknown vulnerabilities and exploits; viruses, worms, Trojans, spyware, phishing and other threats," Touboul continued.

The vulnerabilities discovered at Finjan could allow attackers to "silently and remotely" take control over an affected system when a user visits a malicious Web page. As you well know, enticing someone to visit a Web page is relatively easy to do.

The company outlined several scenarios to better explain the risks:

Upon learning of this news story a spokesperson for Microsoft said the company "is aware of the claims by Finjan Software and at this time cannot confirm Finjan's claims of  "ten new vulnerabilities" in Windows XP SP2. Moreover, Microsoft is currently unaware of active attacks against customers
attempting to utilize the alleged vulnerabilities as reported by Finjan.  We have been contacted by Finjan regarding various potential issues as part of the usual responsible disclosure protocol and are actively investigating those issues through our security response process to determine the validity and accuracy of the reported issues."

"Our early analysis indicates that Finjan's claims are potentially misleading and possibly erroneous regarding the breadth and severity of the alleged vulnerabilities in Windows XP SP2.  Once Microsoft concludes investigating Finjan's claims and if Microsoft finds any valid vulnerability in Windows XP SP2, Microsoft will take immediate and appropriate action to help protect customers. "

Other vendors also offer advance notice of unpatched security holes in Windows platforms and related services. For example, eEye Digital Security maintains a Web page of upcoming advisories on their Research site. As of November 10 the page lists one upcoming advisory that relates to remote code execution, which eEye given its highest severity rating. The company notifies the vendor (in this case Microsoft) of vulnerabilities and when the vendor releases a patch then eEye releases its own advisory to the public. Often times knowledge of still other unpatched vulnerabilities can be gathered from intrusion detection systems, which store signatures to recognize attacks.

The practice of notifying the public about the mere existance of security vulnerabilities (not to mention any significant details) is a sore spot in many people's minds. Researchers gain publicity for themselves and their products, and at the same time some claim they offer advance notice in order to keep a tiny bit of pressure on vendors to work quickly to produce patches. Striking a balance in that sort of act is difficult at best since it's not likely that everyone can be pleased all of the time and invariably it's the end users of products who suffer most in the event that too much information is released too soon.