full-disclosure - Re: Internet Explorer URL parsing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <03Dec11.001428-0500_est.223382-15413+9218@ams.ftl.affinity.com>
From: khermansen at ht-technology.com (Kristian Hermansen)
Subject: Re: Internet Explorer URL parsing vulnerability

Shouldn't M$ be held responsible dude?  The guy who discovered the flaw
didn't produce the bad code, M$ did.  If anything, M$ should be sued for
rushing the product to market.  And let the flames begin as this topic has
been discussed all too many times before.  If you don't like the idea of
"FULL DISCLOSURE", then why are you on this mailing list?


Kristian Hermansen
khermansen@...technology.com

-----Original Message-----
On Wed, 10 Dec 2003 09:23:40 +0100 (CET)
Feher Tamas <etomcat@...email.hu> wrote:

> >Proof-of-Concept here:
> >http://www.zapthedingbat.com/security/ex01/vun1.htm
> >
> >Vendor Notified 09 December, 2003
> 
> Unless the bug has already been exploited by malicious people, it was 
> a highly irresponsible act to disclose it to the public, without
> giving Microsoft a reasonable timeframe to produce a fix. It may even
> qualify as a crime!
> 
> Considering the simplicity of this URL faking trick, it will be
> certainly see active use by scammers during this Christmas shopping
> season and thousands of people will be robbed of their online banking
> accounts, etc. The money will boost organized crime and the whole
> society will suffer. A patch would give customers at least a
> theoretical chance to protect themselves and the community.
> 
> I certainly would not object to ZapDingbat getting sued for a few
> billion bucks by M$ or the US Gov't sending him to a long recreation
> at Guantanamo Bay. People like him discredit security research like 
> nothing else and his acts contribute towards legislation that will
> curb people's right to investigate code.
> 
> Regards: Tamas Feher.
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html