Full Disclosure mailing list archives
Re: www.google.com xss vulnerability Using mhtml
From: Michal Zalewski <lcamtuf () coredump cx>
Date: Wed, 26 Jan 2011 10:16:13 -0800
I woudn't like to discourage ppl submitting vulns to vendors but this is the response you'll most likely to get from those kind of vendors no matter what you found in their system. I had more than a dozen similar experience like yours. Now it's public + fixed and you gotta get nothing beside these replies (:
I think you'd be surprised. Our reward panel consists solely of people you would recognize from this list, BUGTRAQ, or vendor advisories; and we are very consistent, timely, and pretty generous in rewarding a large proportion of all incoming reports. Ask around :-) In this particular case, though, the underlying problem is clearly a browser-side flaw that is nearly impossible to fully address on web application side - and one that first surfaced in 2004, then wasn't fully fixed in 2007: http://openmya.hacker.jp/hasegawa/security/ms07-034.txt Even in cases like this, we sometimes reward the reporter when we are given advance notice, and there are clear ways we can protect our users. But in this instance, the report is already public, we are already aware it, and we are trying to deploy basic workarounds in a number of exposed spots; and as noted, realistically, there is a limited recourse any web app provider will have. /mz _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- www.google.com xss vulnerability Using mhtml IEhrepus (Jan 26)
- Re: www.google.com xss vulnerability Using mhtml Christian Sciberras (Jan 26)
- <Possible follow-ups>
- Re: www.google.com xss vulnerability Using mhtml Yigit Turgut (Jan 26)
- Re: www.google.com xss vulnerability Using mhtml Michal Zalewski (Jan 26)
- Re: www.google.com xss vulnerability Using mhtml IEhrepus (Jan 26)
- Re: www.google.com xss vulnerability Using mhtml Michal Zalewski (Jan 26)
- Re: www.google.com xss vulnerability Using mhtml Valdis . Kletnieks (Jan 27)
- Re: www.google.com xss vulnerability Using mhtml IEhrepus (Jan 27)
- Re: www.google.com xss vulnerability Using mhtml laurent gaffie (Jan 27)
- Re: www.google.com xss vulnerability Using mhtml Michal Zalewski (Jan 28)
- Re: www.google.com xss vulnerability Using mhtml IEhrepus (Jan 28)
- Re: www.google.com xss vulnerability Using mhtml Michal Zalewski (Jan 26)