RE: Microsoft Cries Wolf ( again )

["mattmurphy () kc rr com" <mattmurphy () kc rr com>]

> poor billy, we do not care anymore
>
> http://zdnet.com.com/2100-1105_2-1020919.html
[...]

The ZDNet article hit the point right on the head.  It is irresponsible to
leave the vendor uninformed before going public.  Doing that helps
absolutely nobody.  If you're going to take the interpretation of full
disclosure literally, notification of the vendor and the public is
simultaneous.  There will be radicals who say that notifying none is what
should have happened here -- and even that policy is better than blindly
rifling off details of a remotely exploitable buffer overflow to every
kiddie in the world without a workaround of any kind.  The poorly-structured
original post didn't even make the faulty code clear.

If anyone were "crying wolf" here, it is the researcher (known to the list
as "Digital Scream") who reported this.  My research and the research of
others suggests that exploitation of this vulnerability is difficult, but
due to possible other ways to exploit this vulnerability, we can't be
certain.  Honestly, Donnie, expecting any other reaction from Microsoft but
disgust is completely insane.

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html