"Microsoft has explained why it took seven years to patch a known
vulnerability. Fixing the bug earlier would have taken out network
applications and potential exploits alike, it explained.
Security bulletin MS08-068
fixed a flaw in the SMB (Server Message Block) component of Windows,
first demonstrated by Sir Dystic of Cult of the Dead Cow fame at a
hacking conference in 2001, if not before. The flaw opened the door to
SMB replay or reflection attacks that would have allowed the operator
of a malicious SMB server to run exploits on vulnerable PCs.
The flaw was rated as important by Microsoft but critical by some
independent security watchers, such as the SANS Institute’s Internet
Storm Centre.
Microsoft explained the delay on issuing a patch on the effect a fix would have had on network-based applications. In a post
on Microsoft’s Security Response Blog, Christopher Budd explains that
the SMBRElay attack worked in much the same way as its legacy NTLM
protocol.
"When this issue was first raised back in 2001, we said that we
could not make changes to address this issue without negatively
impacting network-based applications. And to be clear, the impact would
have been to render many (or nearly all) customers’ network-based
applications then inoperable," Budd explained."
Read more: http://www.theregister.co.uk/2008/11/17/ms_explains_patch_delay/
