Microsoft Browser Patch Released, Serious Security Questions Raised

War of Words Between Software Giant and Security Firm Breaks Out

The awaited security patch for the Microsoft Internet Explorer browser update was finally released on Friday, August 24, two days after originally promised. The security update for the browser update, which was released on August 8, is promised to "fully resolve" the security bug embedded in the Explorer program.

Major problems were almost instantly experienced by websites using HTTP 1.1 compression to speed up image downloads. The Explorer browser often failed when HTTP 1.1 kicked, and web-based applications from PeopleSoft, Siebel and Sage CRM had serious compatibility issues with the software.

Microsoft had released a handful of earlier announcements upon being informed of the problem. Officials promised that the issue does not affect users of Microsoft's latest Service Pack 2 version of Windows XP. Those employing Internet Explorer 6 Service Pack 1 on Windows 2000 Service Pack 4 and Windows XP Service Pack 1 were affected.

Following this, Microsoft released a "hotfix" download to solve the problems. Ultimately the Microsoft brain trust decided problems were serious enough to rerelease the whole update, including the fixed patch. Further errors revealed in final testing made necessary a later released date - and programmers most likely working long long shifts.

Working long shifts, too, was eEye Digital Security, developer of endpoint security, network security and vulnerability management software, whose own employees became involved in the situation in order to protect certain unnamed firms under their protection. The oft-quoted line from eEye chief hacking officer Marc Maiffret went "The bad guys basically know about this and know that it's an exploitable scenario."

As a result, the eEye CTO himself pulled an overnight shift in working with Microsoft in investigating the parameters of the security problem. eEye's interests were to issue an alert to clients, but security firms undertaking this sort of practice is highly unusual.