Re: DCOM RPC exploit (dcom.c)

[Chris Paget <chrisp () ngssoftware com>]

On Sun, 27 Jul 2003, Georgi Guninski wrote:

> IMHO releasing the exploit is ethical and legal.
> The root of the problem is m$, they should take responsibility for the worms.

I agree completely that maybe the best way to stop all this is to make vendors
liable for flaws in their products.  I heard rumours that this was being
considered in the US - anyone know what the score is?

Considering that worms are now starting to have real-world consequences when
they DoS the net, it's a lot easier to start saying that a security flaw is
causing direct, tangible, monetary loss to people affected.  Surely this should
make it easier for those who want to see vendors take responsibility for the
code they churn out?

Chris

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html