Re: Vulnerability? Or...not so much?

[David Shettler <dshettle () HOLYCROSS EDU>]

On Sat, Apr 3, 2010 at 10:59 PM, Jason Testart <jatestart () uwaterloo ca> wrote:
> Do you have some way of mitigating the risk?

Unfortunately, the only way to mitigate the risk is to firewall, which
inconveniences users, and may require a larger deployment of our VPN
than we had spec'd on the VPN.  The application is built around the
flaw and depends on it, and there's no way to discern between
authorized and unauthorized attempts to view the files.

> I agree with you, the vendor has no business accepting the risk.  If the
> vendor refuses to acknowledge this as a security issue, then the vendor
> shouldn't have a problem if you shared the issue with other institutions.
>  Right?

Well put, sir.