full-disclosure - 3 new MS patches next week... but none fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040111133214.GA4895@deneb.enyo.de>
From: fw at deneb.enyo.de (Florian Weimer)
Subject: 3 new MS patches next week... but none fix

Tim wrote:

> I realized that M$ must be giving pre-release information to major
> vendors.  Probably for a heafty price tag.

You receive additional information if you are a Premium Support
customer, such as a rough sketch of the upcoming security patches
(affected products, severity of the vulnerabilities). Especially for
those of us who live in time zones in which patches typically aren't
released during the core working hours, this can help planning (techs
aren't allowed to go home before 2 pm EST on the patching days,
independent of local time, for example).

However, I'm not sure if all Premium Support customers are treated
equally.  Before the invasion of Iraq, an IIS WebDAV exploit was
allegedly making its rounds, and in order to protect US interests,
there was disturbingly little information sharing, at least across the
ocean.