Bugtraq mailing list archives
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
From: Gadi Evron <ge () linuxbox org>
Date: Fri, 24 Mar 2006 12:03:59 -0600 (CST)
On Thu, 23 Mar 2006, Eric Allman wrote: <snip mostly relevant good replies by Mr. Allman>
Talk to the vendors. I've seen quite a few of their advisories come by.
After or before it hit the news? You may be able to alert vendors, but the problem with critical infrastructure is that is widely deployed around the world. Releasing the way you did is irresponsible. You can do non-disclosure for a while or full disclosure, you can't do both.
Commentary
== personal opinion
Yes, that's true. If it's exploitable and people don't update, then those people who choose to ignore the problem will be vulnerable. You could say that about every vulnerability that has ever existed.
Indeed. And yet blaming the user is not how you solve the problem, is it? The Internet being insecure is a give, do you blame the Internet for telnet not being secure, or do you create SSH? How long before enough Sendmail servers globally are patched?
A mounth!Are you suggesting that it would have been better for us to have released the problem without giving vendors any time at all to get it integrated? I think that would be seriously irresponsible.
I agree, my point is that if you release, do it as soon as you can as you ARE critical infrastructure. If you want to let vendors get something done, wait a whole lot longer than a month. Gadi.
Current thread:
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow), (continued)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 24)
- RE: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Michael A Fusaro II (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Casper . Dik (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Claus Assmann (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Eric Allman (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Eric Allman (Mar 25)