Re: MSIE (mshtml.dll) OBJECT tag vulnerability

["meta security" <metasec () gmail com>]

Full Disclosure is a good thing and anyone involved in the security
community should be thankful for its existence!  If people actually believe
that the 0-days posted to this list are all 100% unique.... all i can say is
wow, you're disconnected.  Lets pretend for a second that this was never
posted - does anyone honestly think that there isn't someone else (someone
with serious malicious intent) out there working around the clock to hammer
out IE exploits?  If you don't then you're naive and enjoy a false sense of
security!  That same person with malicious intent will eventually, or worse,
might have already discovered this same problem and guess what?...they're
not going to tell anyone!  Well they might tell others, but its certainly
not going to be vendor or most of the people reading this list.  At least
with disclosures like Michal's the community is made aware of the problem
and can be on the lookout for attacks that might otherwise go undetected.
Yes, pushing the problem to the surface might cause other less skilled
attackers to latch on and start exploiting the vulnerability -- But this
also leads to definition updates from AV companies, or if mountains feel
like moving, releasing a patch out of cycle, both are good things.  What it
really comes down to is awareness and that's exactly how this helps the
community, it keeps everyone alert and on their toes, if that's not your cup
of tea then you're in the wrong industry.  Personally, I would rather know
about the problem before the patch drops...maybe this is a weird concept,
but i have a feeling one or two people agree with me.




On 4/27/06, Tim Bilbro <trbilbro () verizon net> wrote:
> Setting aside analogies, the questions remain: Does full disclosure make
> the IT community as whole less secure than it would otherwise would be?
> Is it more dangerous to have a handfull of sophisticated blackhats
> lurking about with an unknown exploit vs. publishing it for every
> wannabe hacker to use?  I am confident that the answer is that fully
> disclosing discovered vulnerabilites without first giving the vendor a
> reasonable chance to address them is more harmful. There is no question
> that vendors, particulary Microsoft, have a history of neglect in this
> area, and folks have a right to be angry with them. Unfortunately, full
> disclosure doesn't hurt them as much as it hurts the information
> security community as a whole. While not patronizing the vendor because
> of the neglect is the most logical choice, it is an impracticality for
> many. I don't question the right or ethics of full disclosure. It's just
> pain in the neck that might otherwise be avoided or at least minimized.
> It's not helping.
>
> -----Original Message-----
> From: Larry Seltzer [mailto:larry () larryseltzer com]
> Sent: Wednesday, April 26, 2006 4:34 PM
> To: bob () coldrain net; 'Tim Bilbro'
> Cc: full-disclosure () lists grok org uk
> Subject: RE: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag
> vulnerability
>
>
> There aren't people out there looking to exploit the flaws in your car
> in order to drive it where they want it to go. It's a lousy analogy.
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/ http://blog.eweek.com/blogs/larry%5Fseltzer/
> Contributing Editor, PC Magazine
> larryseltzer () ziffdavis com
>
> -----Original Message-----
> From: full-disclosure-bounces () lists grok org uk
> [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of
> bruen () coldrain net
> Sent: Wednesday, April 26, 2006 4:25 PM
> To: Tim Bilbro
> Cc: full-disclosure () lists grok org uk
> Subject: Re: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag
> vulnerability
>
>
> Hi Tim,
>
>    Perhaps instead of viewing this as breaking into locked doors and
> look at it as consumer product information, such as problems with my
> automobile, it would not appear as such a big deal. I like product
> recalls and keeping vendors honest. Product safety has improved
> significantly over the past 20 years because of the openness of the
> flaws. I am sure that software has and will continue to benefit from
> full disclosure of their flaws.
>
>                     cheers, bob
>
>
> On Wed, 26 Apr 2006, Tim Bilbro wrote:
>
> > You do a disservice to all IT shops by announcing these
> > vulnerabilities before contacting the vendor. I am sure it would not
> > generate as much web traffic to your site, but it is only fair and
> > right to allow at least some amount of time for the vendor to respond.
>
> > If you think you are helping, you are wrong. Would you go around town
> > checking which stores are unlocked at night and then publish the list
> > in the news before letting the shop owners know? That's pretty much
> > what you are doing. It's just not helping. There is no proof that it
> is
> either.
> > Tim Bilbro
> > Information Security Specialist
> > CISSP, MCSE
> > trbilbro () verizon net
> > web: www.bloglines.com/blog/Bilbro
> > RSS: www.bloglines.com/blog/Bilbro/rss
> --
> Bob Bruen
> Cold Rain Technologies
> http://coldrain.net
> +1.802.579.6288
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/