TippingPoint purchased the rights to the flaws and attack code from Vreugdenhil, Nils and the other Pwn2Own winners. It will turn over that information to Microsoft, Mozilla and other affected vendors on Friday at the conclusion of the contest. Until vendors patch their vulnerabilities, TippingPoint will not disclose any technical information about the bugs.
Both Microsoft and Mozilla had representatives at hand during the contest.
Later, Jerry Bryant, a senior manager with the Microsoft Security Research Center (MSRC) acknowledged the vulnerabilities exploited by Vreugdenhil, but little else. "Microsoft is aware of a new vulnerability in Internet Explorer introduced at CanSecWest in the Pwn2own contest," Bryant said in an e-mail Wednesday. "We are investigating the issue and we will take appropriate steps to protect customers when the investigation is complete."
Bryant did not say when Microsoft would patch the flaws Vreugdenhil used. The company's next scheduled Patch Tuesday is April 13, but Microsoft typically takes much longer to produce its fixes, with testing time alone often running 30-60 days.
The lesson from this year's Pwn2Own is pretty simple, suggested Charlie Miller, another of Wednesday's winners. "What you can see at Pwn2Own is that bugs are still in software, and exploit mitigations like DEP and ASLR don't work. Even as [defensive measures] improve, researchers still end up winning."
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers, and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed. His e-mail address is email@example.com.
Read more about cybercrime and hacking in Computerworld's Cybercrime and Hacking Knowledge Center.