full-disclosure - MSIE (mshtml.dll) OBJECT tag vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Apr 27 21:44:35 2006
From: lcamtuf at dione.ids.pl (Michal Zalewski)
Subject: MSIE (mshtml.dll) OBJECT tag vulnerability

On Thu, 27 Apr 2006, Tim Bilbro wrote:

> There is no question that vendors, particulary Microsoft, have a history
> of neglect in this area, and folks have a right to be angry with them.

I'm not angry with Microsoft. It's just a company, and not a particularly
evil one. I simply believe that there is no longer a reason to be nice to
MSRC and go to the extremes to protect Microsoft's customers.

Although I'm willing to cooperate with friendly vendors in order to
minimize eventual damage (you both should do some background research,
really), it is ultimately that vendor's duty to care for their customers,
and take responsibility for own mistakes.

If customers are repeatedly burned by vendor's negligent coding practices,
the vendor ought to be pressured into making security a priority, and
collaborating with the infosec community to ENCOURAGE responsible
disclosure, not DEMAND it and issue reprimands to those who disobey them.

It is not my job to withold information on product flaws at all costs, or
to repeatedly bug the vendor for 3-6 months or more to fix a problem. A
bonus fact: I'm not planting bugs in their software, either.

Why didn't I even try, you say? Past experiences of numerous researchers
aside, consider this: Microsoft takes 3-6 months to fix critical but
non-public vulnerabilities in their flagship software (some of these flaws
must've been independently discovered by the rogues, hence putting
customers at great risk, or at best taking chances). This is not a
reasonable timeframe, compared to industry averages. Yet, they only take
2-4 weeks to fix publicly disclosed bugs - thus making software safer,
sooner.

> Unfortunately, full disclosure doesn't hurt them as much as it hurts the
> information security community as a whole.

You're making an argument for no disclosure and no accountability...

...by saying that it sucks for infosec workers to have to do some actual
work, rush workarounds, write IDS signatures - based not on guesses,
but on useful information...

...and you're making this argument On a full disclosure mailing list.

Bravo.

Now if you excuse me... I feel as if I'm being trolled.

Have you guys considered pursuing a Usenet career?

/mz