When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Lessons learned from the Animated Cursor Security Bug

Michael Howard here. A core tenet of the SDL is to take and incorporate lessons learned when we issue a security update, and there is a great deal to learn from the recent animated cursor bug, MS07-017, so I want to spend a few minutes to go over some of the things we have learned from this bug.

First of all, this code is pretty old; is in Windows 2000, and predates the SDL. The SDL has parts (i.e., design review, threat modeling, testing, and security push) that focus on the product as a whole, and parts (i.e., code review and use of tools) that are focused on code. In the Windows Vista process, we banned certain APIs, like strcpy and strncpy, and changed well over 140,000 calls to use safer calls. memcpy wasn't on that list. We also built in a lot of defense-in-depth measures because we know that the SDL can't catch everything. Let's start by looking at some of the defense-in-depth measures we have in place that didn't stop the threat

View: The full story
News source: MSDN Blog

Report a problem with article
Next Article

Office 2003 SP3 to be mainly a security upgrade

Previous Article

Windows Vista = Windows Me II?

Join the conversation!

Login or Sign Up to read and post a comment.

9 Comments - Add comment