Gartner Questions Microsoft's Commitment To Operating-System SecurityGartner Questions Microsoft's Commitment To Operating-System Security

Research firm Gartner issued a note late Thursday that raises serious questions about Microsoft's internal commitment to rid its operating system of security holes that make worms such as MS Blaster, SQL Slammer, and Code Red possible.

The report from Gartner was spurred by the Abstract Syntax Notation vulnerability which Microsoft made public and issued a corrective patch for earlier this week. The vulnerability affects most every modern version of the Windows operating system and most security experts agree systems that aren't quickly patched are at high risk of hacker attacks or a quick-spreading Internet worm.

"This smells like Blaster all over again," says John Pescatore, a research director at Gartner and one of the authors of the report. But Pescatore warns that this vulnerability could prove worse than the vulnerability that made MS Blaster possible. Blaster created havoc for system operators in August 2003, the same week as the major blackout that left many in the Northeast without power. The ASN.1 vulnerability can be accessed through port 80, as well as other ports widely used to communicate over the Internet.

Pescatore says April marks the one year ship date for Windows Server 2003 and he had hoped Microsoft's internal push to improve the security of its applications would have caught these types of flaws. He said it was troublesome that these types of flaws have been uncovered by external security researchers and not by Microsoft.

Eeye Digital Security was the company that found the ASN.1 vulnerability and reported it to Microsoft in July of last year. The vulnerability that MS Blaster attacked, which was within Microsoft's Distributed Component Object Model (DCOM) Remote Procedure Call interface, was discovered by The Last Stage of Delirium Research Group.

The ASN.1 vulnerability exists in versions of Windows prior to Windows 2003 Server, including Windows NT and 2000. "These old bugs being found in Windows 2003 are more worrisome than if only new bugs that only affected Windows 2003 were found," says Pescatore. "It means they've not been doing enough to find these holes on their own."

Gartner had previously recommended to its clients that they delay deployment of Windows 2003 Server in "sensitive Internet-exposed applications" until sometime after the second half of this year, but the note published Thursday indicated the firm may change its recommendation.

"We may have to revise even this cautious position if Microsoft fails to commit publicly to extraordinary efforts to eliminate glaring holes in its operating systems. Enterprises should continue to heavily weight the cost of continually patching Microsoft products when deciding which operating system to purchase," the report stated.

Gartner recommends companies immediately:

Install the Microsoft patch on all PCs and servers; Block vulnerable ports as they are identified; Configure enterprise firewalls correctly to limit exposure; and Install personal firewalls on all PCs and intrusion-prevention software on all business-critical Windows servers.

In a statement E-mailed to information, Microsoft said that it never expected to perfect security overnight, but it continues to believe that Window Server 2003 demonstrates significant progress.