Ummm.. Actually there's no "may" about it: http://blogs.technet.com/msrc/archive/2009/07/09/questions-about-timing-and-microsoft-security-advisory-972890.aspx
[blockquote]
Before I go into the details, the key thing I want customers to understand is that this is an issue that was responsibly reported to us and we have been driving in our standard process towards a security update. While in the middle of that process, attackers found this same vulnerability and began attacks against it. We were far enough in the process that we could provide information that customers can use to protect themselves in the interim while we complete that investigation and deliver a security update that you can deploy broadly with confidence. Like Jerry said, we’re targeting next Tuesday to release this update.
In terms of timeline, we received the original report from Ryan Smith and Alex Wheeler with IBM ISS X-Force in the early Spring of 2008. The CVE number assigned to this, CVE-2008-0015, can make it look older but that’s because IBM (like Microsoft) gets CVE numbers in large blocks and assigned them sequentially to issues.
...
We always aim to be thorough in our investigations. For any issue that is reported to us, we strive to address not only the vulnerabilities brought to us but also to find any similar or related issues to ensure the update provides as comprehensive security as possible. And once we confirmed that issue we expanded our investigation to be thorough.
In the case of this particular issue, part of our investigation showed other interfaces were vulnerable, in this ActiveX Control, not only the one seen used in attacks.
[/blockquote]
According to the blog post, even though the vulnerability was disclosed to MSFT in the spring of 2008, attackers only discovered and started using it relatively recently (just before it was scheduled to be released).
The bottom line is that doing due dilegence takes time. It's far better to take care when making a security fix than it is to break users browsing experience.
http://starkravingfinkle.org/blog/2008/03/extension-developers-breaking-news-part-2/
http://news.cnet.com/Apple-OS-X-security-fix-busts-64-bit-support/2100-1002_3-5837406.html
And MSFT has had issues too: http://www.betanews.com/article/MS-IE-Patch-Causing-Browser-Crashes/1155745873
That's why you take your time in testing these fixes, especially when there's no evidence that attackers are exploiting the vulnerability.
WindowsClient: New WPF Showcase Addition: Enterprise
TechNet Edge: Windows Server 2008 R2 : New Power Management Features
