bugtraq - Re: Privilege escalation in Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 15 Aug 2005 08:01:13 -0700
From: Reed Arvin <reedarvin@...il.com>
To: NoBrain NoPain <nobnop@...il.com>
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	vuln@...unia.com, news@...uriteam.com
Subject: Re: Privilege escalation in Network Associates
	ePolicy Orchestrator Agent 3.5.0 (patch 3)

Hmm...that is interesting. I assure you that they were notified and
were given all of the information in the original post to
Full-Disclosure at
http://lists.grok.org.uk/pipermail/full-disclosure/2005-August/036022.html
well before it was posted. I was surprised that there was no reply
also.

However, they are a large company. Things can slip through the cracks
I guess. As to the statement that was made about not following
"standard industry practices", I could only assume that they would add
that to save face. But it doesn't bother me too much because I had the
best of intentions when attempting to notifying them and disclosing
the vulnerability.

On 8/15/05, NoBrain NoPain <nobnop@...il.com> wrote:
> Hello,
> 
> Reed Arvin wrote:
> > Patches/Workarounds:
> > The vendor was notified of the issue. There was no response.
> 
> Vendor Response:
> http://knowledgemap.nai.com/KanisaSupportSite/search.do?cmd=displayKC&docType=kc&externalId=KBkb42216xml&language=en_US
> 
> One can find there: "McAfee was not notified in advance of this
> vulnerability per "standard industry practices". It would be
> interesting when you contacted McAfee and what you told them...;)
> 
> -- nobnop
>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/