« My blog gets respectable | Main | Martin McKeay's Podcast »

March 28, 2006

3rd Party Patches - Should you use them?

I was reading an article today, on the temporary patch that eEye Digital Security has created for an unpatched vulnerability in Internet Explorer.  Microsoft is supposedly working on a patch for this one as well, and may even release an out of cycle patch for it shortly.  In that event, the eEye patch is supposed to uninstall itself.  For those of you who do not know, eEye is a company that sometimes finds and frequently announces the existence of vulnerabilities as part of their vulnerability scanner research and other security products line. 

The significance of this for me, is that this is the 2nd time in the last few months that a 3rd party has released a patch for an MS vulnerability.  The first time was with the WMF flaw and the patch that came out by Ilfak Guilfanov.  Though originally hailed as a positive, when it became known that the patch caused problems with certain printing functions, the potential for problems with 3rd party patches became apparent.  That is, that at best the quality of 3rd party patches  could be uneven  compared to  patches  from  the  vendors  who actually  own  the vulnerable  application (though vendor patches can be of poor quality too).  In spite of this possibility, it seems like 3rd party patches are going to keep appearing. In fact, I wonder if a company like eEye, who gains a lot of publicity by announcing vulnerabilities sees an extension of this PR or even a business model around releasing 3rd party patches.  If the quality is good, why not?  Another view is that 3rd party patches force vendors into speeding up availability of their own patches.  This could be a good thing or perhaps forces a vendor to release a patch before the full QA is completed, in which case we all suffer.  In any event, I think 3rd party patches will have an effect in vulnerability management strategies going forward.

TrackBack

TrackBack URL for this entry:
http://www.typepad.com/services/trackback/6a00d83451e4d369e200d8345b33bf69e2

Listed below are links to weblogs that reference 3rd Party Patches - Should you use them?:

» 3rd Party Patch Perspectives from Security Incite: Analysis on Information Security
Did you like the alliteration I used in the title? Kidding aside, Microsoft is again being called to the carpet about how long its taking to release patches, especially when exploit code is in use in the wild. Thats a good thing, but the questio [Read More]

Comments

Search

Lijit Search

disclaimer

  • The views and opinions expresed here are those of myself only and in no way represent the views or positions or opinions of my employer, Latis Networks, Inc. d/b/a StillSecure or anyone else.

Blog Networks

  • Find the best blogs at Blogs.com.

StillSecure, After all these years, the podcast

Blog powered by TypePad
Member since 10/2005