Linked by Thom Holwerda on Thu 5th Jan 2006 21:24 UTC
Windows Microsoft has officially released the patch that fixes the WMF flaw. The patch can be download individually here, but it is advised to simply use Windows Update. Yesterday, Microsoft said it would not release it until next Tuesday, but two (1 | 2) third party fixes were already available. And to make matters worse, Microsoft accidentally leaked their own patch to the Net yesterday.
Permalink for comment 82254
To read all comments associated with this story, please click here.
1 week??
by ZaNkY on Thu 5th Jan 2006 23:04 UTC
ZaNkY
Member since:
2005-10-18

That is so true, I plan on going around tomorrow to various people I meet during the course of my day and ask them: So what do you think about WMF?

See how many people will have a clue.....lol

and Thom:

I don't know exactly how long the vuln has been "known", but lets say one week.

7 * 24 = 168 hours

It takes probably an hour to write up a patch for this vuln. Please don't flame me for saying ONE hour. I'm sure it could be done in that time considering all the "unofficial" patches that have popped up and all those instructions to unregister a dll and stuff like that....doesn’t seem hard to me…. But let’s give MS the benefit of the doubt and say it takes longer.

bottom line is that the patch can be written in a day. Especially considering how critical it is and the "potential" for damage. next? TeStInG. How long can that possibly take? I would go as bold to say again a couple hours, possibly a whole day.

So we're looking at 2 days to write a patch, test it, and then distribute it. And do so on the first available moment (not next Tuesday! ;) ). 2 days = 48 hours. There’s 120 hours left there….

This is all considering that A multi-billion (perhaps trillion) dollar company, with near endless resources and motivation, who LOVES their customers and wants only to do good is involved.

If you notice, the first ones above apply to MS, but they get bleaker and bleaker ;)



To sum up, Thom: 1 week to write a patch for a vuln is ok. 1 week to write a CRITICAL patch that has near invincibility and affects nearly the entire world (sadly)? NOT OK.

--ZaNkY

Reply Score: 1