ISS Apache Advisory Response

["Klaus, Chris (ISSAtlanta)" <CKlaus () iss net>]

There has been a lot of misinformation spread about our ISS Apache Advisory
and wanted to clean up any confusion and misunderstanding.
 
1)      Our policy for publishing advisories is to give a vendor 30 to 45
day quiet period to provide an opportunity to create a patch or work around.
If an exploit for the vulnerability appears in the wild, or a patch and
work-around is provided by the vendor or ISS X-Force, this quiet period is
disregarded and the ISS X-Force advisory is published immediately.
 
In the case of this advisory, ISS X-Force provided an Apache patch and did
not see a need for a long quiet period.
 
2)      The original ISS X-Force Apache Patch did work properly against the
specific vulnerability described by X-Force, despite claims that it did not.
The Apache and CERT advisories on their websites have been corrected to
reflect this.
3)      ISS was not aware of other researchers discovering this
vulnerability nor aware of it in the wild at the time of the release of the
advisory.
4)      Following along with Presidential Decision Directive-63, ISS had
cooperated and coordinated with National Infrastructure Protection Center
(NIPC) on this advisory.  We will continue to work with NIPC on upcoming
advisories.
5)      The Gobbles' exploit has confirmed our decision to release as soon
as possible based on our assumption that others were likely to discover the
same vulnerability in the wild.
6)      We do not view this as a race to beat other researchers to releasing
an advisory, but a race to protect our customers in a timely manner. 
 
Due to the general nature of open-source and its openness, the virtual
organizations behind the projects do not have an ability to enforce strict
confidentiality.  By notifying the open source project, its nature is that
the information is quickly spread in the wild disregarding any type of quiet
period.  ISS X-Force minimizes the quiet period and delay of protecting
customers by providing a security patch.
 
ISS has made these decisions based on our mission to provide the best
security to our customers and being a trusted security advisor. 
 

Sincerely,
Christoper W. Klaus

***********************************************************************
Christopher W. Klaus
Founder and CTO
Internet Security Systems (ISS)
6303 Barfield Road
Atlanta, GA 30328
Phone: 404-236-4051 Fax: 404-236-2637
web http://www.iss.net
NASDAQ: ISSX
Internet Security Systems ~ The Power To Protect