Microsoft's Vulnerabilities Already Exploited by Reverse Engineering

With the release of the 12 patch package for the 21 security flaws in Windows, Office and Exchange Server, the Redmond company has offered hackers the possibility to speculate the patches to their advantages.

Therefore more than a third of Microsoft's vulnerabilities have already been exploited through "reverse engineering", a method that permits hackers to analyze the code of the patches in order to discover the flaw meant to be repaired.

VeriSign iDefense Company has announced Wednesday that it has found exploits for 5 out of the 21 of Microsoft's security vulnerabilities. The Word flaw, two of the ones in Internet Explorer, one in Media Player and the critical vulnerability which allows for "routing and remote access" are the first to be exploited.

"Exploit code had already existed for three of the vulnerabilities prior to yesterday, as they were already public issues," said Michael Sutton, director of VeriSign Inc.'s iDefense Labs. "Beyond that, we're seeing public exploit code emerge for some of the new vulnerabilities and are hearing rumors of private code existing for others."

The exploits emerged following the release or proof-of-concept code samples that demonstrate how the patches work.

"We believe that it is far more beneficial to withhold proof-of-concept code for an amount of time so that customers can get the vulnerabilities patched," said Stephen Toulouse, security program manager at Microsoft's security response center. "The public broadcasting of code so quickly after a bulletin release, we believe, tends to help attackers."