full-disclosure - OpenSSH - is X-Force really behind this?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200309221531.h8MFV3Ag005864@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: OpenSSH - is X-Force really behind this? 

On Mon, 22 Sep 2003 12:06:03 +0200, Michal Zalewski said:

>     ...why would there be any exploits in the wild if they have
>     indeed discovered the flaw on their own? Though I'm trying
>     really hard, I can't read "we discovered a flaw" as "we have
>     overheard about a flaw" or "we are aware of a flaw".

Charles Darwin and Alfred Wallace independently came up with
the concept of natural selection.

Remember - it's open source, it isn't like the ISS X-Force guys sprinkled
magic exploit dust on a printout and the flaw was revealed to them alone.
More likely, they found the bug, and then realized that if they could find
it, a black hat with an unpublished exploit could have found it too.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030922/387a3b31/attachment.bin