alt Hacker NewsIt's quite a sad story, when people working in Microsoft used to be the experts of all experts on Windows, and at the present moment people from outside know Windows better... It seems like the only people left in there are maintainers...
Replies
If you look at the first binary patch for Equation Editor, it's very well done: https://blog.0patch.com/2017/11/did-microsoft-just-manually-... . The problem was that when they fixed it once, other researchers started fuzzing Equation Editor and found many more bugs. Bringing a C++ program from 2000 up to modern security standards when you don't have the source code isn't really feasible, it would be an endless series of whack-a-mole binary patches. I don't really blame Microsoft for dropping support, especially when there's been a replacement equation editor in Office since 2007.
I guess it's prompt writers
Microsoft last patched the tool by manually patching the binary executable. It seems like they don't have the source code for the tool anymore. There was also a long string of vulnerabilities in the tool, which seems to have stopped being updated at source level somewhere around 2000 based on the copyright in the screenshot.
MS should write an alternative to the tool (and I believe they have done so at some point in modern versions of Office), but removing this piece of abandonware was the right call.