bugtraq - Re: Microsoft Internet Explorer - Crash on adding sites to restricted zone (05/28/2005)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200506010207.j5127vXs004646@linus.mitre.org>
Date: Tue, 31 May 2005 22:07:57 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: Microsoft Internet Explorer - Crash on adding sites to restricted zone (05/28/2005)

Many browser crashes can be directly triggered by an attacker from a
malicious web page, which makes a reasonable argument for calling such
problems a "vulnerability" or some other term that implies some impact
on confidentiality, integrity, or availability.

However, as described, this particular issue seems to require manual
steps on the user's part, and the attacker has little or no role in
the "exploit," barring social engineering.

There seems to be an implicit agreement that self-inflicted DoSes
don't cross any security boundaries and thus are not security
relevant.

The question, then, becomes whether this particular issue is more of a
"bug" than a "vulnerability" ?  If it's a "vulnerability," then how do
you distinguish this from other problems that are just "bugs" ?

- Steve