Some customers are fed up. "It is truly frustrating. I have vowed to eliminate using any Microsoft products because I am so frustrated over their Take a standard and modify it approach," said James Rome, a senior scientist at Oak Ridge National Laboratory, in Oak Ridge, Tenn. "[But] it is impossible to not use IE. It lurks under the covers everywhere. If you do something like disable scripting in IE, other applications break.""From the outside, there doesnt appear to be a reason Microsoft cant fix the immediate issue," said Scott Blake, vice president of information security at BindView Corp., in Houston. "[However] it doesnt solve the larger problem that it is possible to social engineer people into giving away confidential information over the Web to people they dont intend to give it to," Blake said. "This flaw makes it easier, but fixing [it] doesnt fix the problem." Culp said the SSL problem is actually in the Windows code and not IE, which would complicate the process of producing a patch. A similar situation occurred earlier this month when a researcher released a white paper claiming that the Win32 programming API in Windows is flawed in a way that allows attackers to gain escalated privileges once theyve accessed a PC. Microsoft did not make any public statements about the issue. "They cant say anything definitive until they really know for sure, but they should make some statement," said Chris Wysopal, director of research and development at @Stake Inc., a Cambridge, Mass., security consultancy and research company. "[The SSL problem] isnt a totally simple issue. But when they stay silent, it looks like they dont care." Wysopal also disputed Microsofts claims that attacks using the SSL vulnerability are unlikely. An attacker would use a stolen SSL certificatenot his ownmaking identification of the attacker much more difficult. Related stories:
IE Flaw Leaves Users Open to Data Theft
Microsoft Patch Fixes Critical MCMS Flaws
Microsoft to Boost Security Response
Microsoft Shelled Out Millions on Security
Interview: Trusting in Microsoft
Whither Internet Explorer?
More Security Coverage
Others say that the problems often dont end when Microsoft does issue a patch.