Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

[Gadi Evron <ge () linuxbox org>]

On Thu, 23 Mar 2006, Eric Allman wrote:

<snip mostly relevant good replies by Mr. Allman>

> Talk to the vendors.  I've seen quite a few of their advisories come 
> by.

After or before it hit the news? You may be able to alert vendors, but
the problem with critical infrastructure is that is widely deployed around
the world. Releasing the way you did is irresponsible.

You can do non-disclosure for a while or full disclosure, you can't do
both.

> > Commentary

== personal opinion

> Yes, that's true.  If it's exploitable and people don't update, then 
> those people who choose to ignore the problem will be vulnerable. 
> You could say that about every vulnerability that has ever existed.

Indeed. And yet blaming the user is not how you solve the problem, is it?
The Internet being insecure is a give, do you blame the Internet for
telnet not being secure, or do you create SSH?

How long before enough Sendmail servers globally are patched?

> > A mounth!
>
> Are you suggesting that it would have been better for us to have 
> released the problem without giving vendors any time at all to get it 
> integrated?  I think that would be seriously irresponsible.

I agree, my point is that if you release, do it as soon as you can as you
ARE critical infrastructure. If you want to let vendors get something
done, wait a whole lot longer than a month.

        Gadi.