Security Vendors: Do No Harm, Heal Thyself

Security companies would do well to build their products around the physician’s code: “First, do no harm.” The corollary to that oath borrows from another medical mantra: “Security vendor, heal thyself. And don’t take forever to do it! ”
On Thursday, Symantec quietly released security updates to fix serious vulnerabilities in its Symantec Web Gateway, a popular line of security appliances designed to help “protect organizations against multiple types of Web-borne malware.” Symantec issued the updates more than five months after receiving notice of the flaws from Vienna, Austria based SEC Consult Vulnerability Lab, which said attackers could chain together several of the flaws to completely compromise the appliances.
“An attacker can get unauthorized access to the appliance and plant backdoors or access configuration files containing credentials for other systems (eg. Active Directory/LDAP credentials) which can be used in further attacks,” SEC Consult warned in an advisory published in coordination with the patches from Symantec. “Since all web traffic passes through the appliance, interception of HTTP as well as the plain text form of HTTPS traffic (if SSL Deep Inspection feature in use), including sensitive information like passwords and session cookies is possible.”
Big Yellow almost certainly dodged a bullet with this coordinated disclosure, and it should be glad that the bugs weren’t found by a researcher at NATO, for example; Earlier this month, security vendor McAfee disclosed multiple vulnerabilities in its ePolicy Orchestrator, a centralized security management product. The researcher in that case said he would disclose his findings within 30 days of notifying the company, and McAfee turned around an advisory in less than a week.
Interestingly, Google’s security team is backing a new seven-day security deadline that would allow researchers to make serious vulnerabilities public a week after notifying a company. Google says a week-long disclosure timeline is appropriate for critical vulnerabilities that are under active exploitation, and that its standing recommendation is that companies should fix critical vulnerabilities in 60 days, or, if a  fix is not possible, they should notify the public about the risk and offer workarounds.

It seems to me that we ought to hold companies that make security software and hardware to a higher standard, and expect from them a much more timely response. It’s true that products which are widely deployed require more thorough testing to ensure any patches don’t introduce additional problems. But to my mind, 30 days is more than plenty to address these vulnerabilities.
Johannes Greil, head of SEC Consult Vulnerability Lab, said security companies need to invest more in securing their own products.
“We only did a short crash test and found those critical vulnerabilities,” Greil said. “I don’t think that it is acceptable to take that long because users are unprotected for that time. I do understand though, that testing the patches is necessary and may take longer. At least they don’t take years as Oracle does sometimes.”