full-disclosure - Re: Internet Explorer URL parsing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: sgmasood at yahoo.com (S G Masood)
Subject: Re: Internet Explorer URL parsing vulnerability

--- Feher Tamas <etomcat@...email.hu> wrote:
> Hello,
> 
> >don't start a disclosure - non disclosure thread
> again and again
> >and again please...
> 
> This is about responsible and non-responsible
> disclosure, which is at 
> the heart of security research.
> 
> As long as you have no proof that the bug is being
> maliciously exploited 
> in the wild, you need to give time for the sw vendor
> to react and patch. 

If you are talking about a generic ethic, I sincerely
agree. Slight deviations on this concept might apply
depending on the vendor's track record and the
vulnerability(I am not talking about MS alone). 

However, unfortunately, if you are familiar with the
pattern in which MS handled the previous unpatched IE
vulns, this looks like one of those IE vulns. that MS
*WONT* patch.

Nevertheless, putting the general public at such high
risk is never a wise idea. 

--
S.G.Masood

> > 
> What Zap the Dingbat has done will not earn him a
> bust in the hall of 
> fame for security research.
> 
> Sincerely: Tamas Feher.
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:
http://lists.netsys.com/full-disclosure-charter.html

__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/