bugtraq - Re: [Advisory] Mozilla Products Remote Crash Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0412071030280.25154@loki.ct.heise.de>
Date: Tue, 7 Dec 2004 10:59:38 +0100 (CET)
From: Juergen Schmidt <ju@...sec.de>
To: Heikki Toivonen <heikki@...foundation.org>
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: Re: [Advisory] Mozilla Products Remote Crash
 Vulnerability

On Mon, 6 Dec 2004, Heikki Toivonen wrote:

> This crash was fixed today.

Great.

> This does not mean crashes will be ignored and will go unfixed. It just
> means that they do not receive the urgency that exploitable crashes and
> other vulnerabilities receive.

But this means, somebody (from mozilla) checked the urgency and decided,
that it can wait. It would have been nice and a minimal effort to inform
the initial reporter about that.

> As a security researcher, I would think it would be your responsibility
> to determine the seriousness of an issue. Just saying an app crashes
> does not make a security researcher IMO. Even my mom would be able to
> report a simple crash.

I do not see Niek claiming to be a security researcher. He stumbled
into something, that might be a security problem and wanted to make sure,
it is treated the right way. He first reported it to bugzilla and after
not getting a response, published the information he gathered.

What should he (or your mother) do, if mozilla is crashing on a
particular web site? Shut up? Learn how to write a buffer overflow
exploit before reporting it?

bye, ju

-- 
Juergen Schmidt       Chefredakteur  heise Security     www.heisec.de
Heise Zeitschriften Verlag,    Helstorferstr. 7,       D-30625 Hannover
Tel. +49 511 5352 300      FAX +49 511 5352 417       EMail ju@...sec.de
GPG-Key: 0x38EA4970,  5D7B 476D 84D5 94FF E7C5  67BE F895 0A18 38EA 4970

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html