Leak prompts Microsoft to audit Windows code
Microsoft Corp. is conducting a security review of the Windows 2000 and NT 4.0 source code leaked onto the Internet earlier this month to determine if there is any risk to its customers, the company said Monday.
"Microsoft is currently performing an in-depth security review of the leaked code," the Redmond, Washington-based software maker said in a statement sent via e-mail.
The code was checked prior to its commercial release, but Microsoft is taking another look at it with more modern review tools.
"Since the commercial release of the source code that was leaked, more sophisticated tools and processes have been developed, and there have been numerous improvements in the security review process," the company said.
Analysts and security experts have warned that the Windows source code breach could lead to an increase in cyberattacks because it would make it easier for hackers to find holes in the operating systems. However, the leaked source code is old and many issues have already been fixed by patches and service packs.
Still, a bug hunter last week claimed to have uncovered a security flaw in Internet Explorer (IE) 5 by studying leaked source code. Microsoft said the problem is a known issue that it had discovered already and fixed in IE 6.0. The company was investigating why the flaw was not patched in IE 5, which is used by millions of Internet users worldwide.
"In order to thoroughly determine whether or not our customers may be impacted by the unauthorized release of this source code, we are reviewing it again," Microsoft said. The company has not assigned a timeline to its review and has yet to decide how to respond to anything the review may uncover, according to the statement.
Some Microsoft customers were concerned that the code leak will require them to install more security patches, although others seemed to consider it business as usual with Microsoft's software.
"This doesn
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
