"Microsoft Corp.'s security team today acknowledged that it knew of
bugs in its Jet Database Engine as far bask as 2005 but did not patch
the problems because it thought it had blocked the obvious attack
vectors.
A researcher at Symantec Corp. said Microsoft should have fixed the flaws years ago.
In a post to the Microsoft Security Research Center (MSRC) blog
late Monday afternoon, Mike Reavey, the MSRC's operations manager,
admitted that outside researchers had notified Microsoft in 2005 and
2007 of separate bugs in Jet, a Windows component that provides data
access to applications such as Microsoft Access and Visual Basic.
In both cases, Microsoft told the researchers that it would
not fix the flaw because it considered users safe. Outlook blocked the
.mdb file format from being opened, Exchange servers stripped them from
incoming messages and Internet Explorer issued warnings when users
clicked on such files, said Reavey about Microsoft's decision.
But the company hadn't thought of the attack strategy now
being used by hackers. "Everything changed with the discovery of this
new attack vector that allowed an attacker to load an .mdb file via
opening a Microsoft Word document," he said. "The previous guidance
does not work against this new attack. So that's why we alerted
customers to these attacks and are re-investigating Jet parsing flaws
— this is a new attack vector discovered that we didn't know about." "
Article Link: http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyNa…
Microsoft Response: http://blogs.technet.com/msrc/archive/2008/03/24/update-msrc-blog-microsoft-security-advisory-950627.aspx
