Visual C++ Flaw Leads To Y3K -- Seriously

Think the software industry learned its lesson with the whole Y2K debacle? Of course not.

The Department of Homeland Security issued a warning this week that there's a flaw in Microsoft's Visual C++ programming environment that could actually cause programs written with it to crash when we pass the Year 3000. Of course, unless today's programs are around in another 993 years, it won't be a drastic issue.But the point is… Have we not already learned that lesson?

"I almost had a déjà-vu moment when I read: CVE-2007-0842," writes Swa Frantzen on the SANS Institute's Internet Storm Center Web site. He's referring to the code name the government gave the flaw. "Some time handling functions in Visual C++ 8.0 can't go beyond Jan 1st 3000. Didn't the industry learn almost a decade ago that dates move on and building any arbitrary limit is a bad idea?"

No, Frantzen, seems they didn't.

The National Vulnerability Database, which is under the umbrella of the Department of Homeland Security, notes that the problem lies in the 64-bit versions of Microsoft's Visual C++ 8.0 standard library.

Johannes Ullrich, chief research officer at the SANS Institute, agrees. I talked with Ullrich Wednesday afternoon and he told me the library inside the compiler for Visual C++ basically doesn't know how to count past 3,000. "Any higher and the system will crash," he says. "Any program written with that compiler will crash beyond the Year 3000."

Ullrich, who also is chief technology officer for the Internet Storm Center, a cooperative cyberthreat monitoring and alert system, laughed and says he was "surprised" by it but mistakes happen.

After all the hubbub around the Y2K issue, not to mention all the money thrown at it, this flaw just made me laugh. At least we'll have plenty of time to get it fixed….