3rd Party Patches - Should you use them?
I was reading an article today, on the temporary patch that eEye Digital Security has created for an unpatched vulnerability in Internet Explorer. Microsoft is supposedly working on a patch for this one as well, and may even release an out of cycle patch for it shortly. In that event, the eEye patch is supposed to uninstall itself. For those of you who do not know, eEye is a company that sometimes finds and frequently announces the existence of vulnerabilities as part of their vulnerability scanner research and other security products line.
The significance of this for me, is that this is the 2nd time in the last few months that a 3rd party has released a patch for an MS vulnerability. The first time was with the WMF flaw and the patch that came out by Ilfak Guilfanov. Though originally hailed as a positive, when it became known that the patch caused problems with certain printing functions, the potential for problems with 3rd party patches became apparent. That is, that at best the quality of 3rd party patches could be uneven compared to patches from the vendors who actually own the vulnerable application (though vendor patches can be of poor quality too). In spite of this possibility, it seems like 3rd party patches are going to keep appearing. In fact, I wonder if a company like eEye, who gains a lot of publicity by announcing vulnerabilities sees an extension of this PR or even a business model around releasing 3rd party patches. If the quality is good, why not? Another view is that 3rd party patches force vendors into speeding up availability of their own patches. This could be a good thing or perhaps forces a vendor to release a patch before the full QA is completed, in which case we all suffer. In any event, I think 3rd party patches will have an effect in vulnerability management strategies going forward.






Comments