The Jailbreakme exploit became public on
April 3, 2010 and was patched on
April 11, 2010. This patch fixed both the local and remote exploit used in Jailbreakme. So, it took 8 days for Apple to fix.
A quick search through the
Microsoft Security Bulletin Summary index shows that this publicly released
UAC bypass (see also
Exploit-db &
CVE-2010-4398) in Windows 7 was not patched until February 8, 2011 as shown in
ms11-feb.mspx. Contrary to the Microsoft Security Bulletin for this patch, proof of concept code exist for the UAC bypass exploit. So, nearly 2 and a half months.
Interestingly, it is in the same class of exploit used to achieve privilege escalation in the
Stuxnet worm that was discovered in July 2010. The
win32k.sys exploit used in Stuxnet was not patched until Oct, 12/2010. So, a little over 3 months.
The win32k.sys exploit in Stuxnet did not work in Vista/7 so another exploit was used to achieve privilege escalation in Vista/7. This
Task Scheduler exploit was not patched until Dec, 14/2010. So, a little over 4 months.
The
remote exploit used in Stuxnet was public on
July 17, 2010 and patched on
August 2, 2010. So, roughly two weeks.
But, those local privilege escalation exploits could have been leveraged by other remote exploits while they remained unfixed.
