Microsoft Tells How It Missed Critical IE Bug

A lack of adequate testing tools and training causes developers to overlook a critical bug

Microsoft developers overlooked a critical bug in the Internet Explorer browser because of a lack of adequate testing tools and training, a company official acknowledged last month.

The flaw, which Microsoft patched with an emergency update, had gone undetected for at least nine years. Michael Howard, a principal security program manager who has been a proponent of the company's secure code-development process, said that Microsoft programmers had not been taught to look for the type of vulnerability that hit the data-binding function of IE.

Even Microsoft's automated "fuzzer" testing tools, which are dropped into applications to find failures, missed the bug, Howard said in a post on the company's Security Development Lifecycle blog.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Internet Explorer

More about Microsoft

Show Comments