full-disclosure - Microsoft Cries Wolf ( again )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: mattmurphy at kc.rr.com (mattmurphy@...rr.com)
Subject: Microsoft Cries Wolf ( again )

> poor billy, we do not care anymore
>
> http://zdnet.com.com/2100-1105_2-1020919.html
[...]

The ZDNet article hit the point right on the head.  It is irresponsible to
leave the vendor uninformed before going public.  Doing that helps
absolutely nobody.  If you're going to take the interpretation of full
disclosure literally, notification of the vendor and the public is
simultaneous.  There will be radicals who say that notifying none is what
should have happened here -- and even that policy is better than blindly
rifling off details of a remotely exploitable buffer overflow to every
kiddie in the world without a workaround of any kind.  The poorly-structured
original post didn't even make the faulty code clear.

If anyone were "crying wolf" here, it is the researcher (known to the list
as "Digital Scream") who reported this.  My research and the research of
others suggests that exploitation of this vulnerability is difficult, but
due to possible other ways to exploit this vulnerability, we can't be
certain.  Honestly, Donnie, expecting any other reaction from Microsoft but
disgust is completely insane.

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .