full-disclosure - DCOM RPC exploit (dcom.c)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.WNT.4.51.0307271045120.552@lara.gremlinhunters.co.uk>
From: chrisp at ngssoftware.com (Chris Paget)
Subject: DCOM RPC exploit  (dcom.c)

On Sun, 27 Jul 2003, Georgi Guninski wrote:

> IMHO releasing the exploit is ethical and legal.
> The root of the problem is m$, they should take responsibility for the worms.

I agree completely that maybe the best way to stop all this is to make vendors
liable for flaws in their products.  I heard rumours that this was being
considered in the US - anyone know what the score is?

Considering that worms are now starting to have real-world consequences when
they DoS the net, it's a lot easier to start saying that a security flaw is
causing direct, tangible, monetary loss to people affected.  Surely this should
make it easier for those who want to see vendors take responsibility for the
code they churn out?

Chris