full-disclosure - How to Report a Security Vulnerability toMicrosoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BAY10-DAV6A7B1DE9661A30811AE1CD93F0@phx.gbl>
Date: Fri Apr  8 22:15:58 2005
From: se_cur_ity at hotmail.com (Morning Wood)
Subject: How to Report a Security Vulnerability
	toMicrosoft

> On Fri, Apr 08, 2005 at 12:21:05PM -0700, Microsoft Security Response
Center wrote:
> > If you believe you have found a security vulnerability affecting a
> > Microsoft product, we would like to work with you to investigate it.
> >
>
> hahahahahaha
>
> m$ doing social engineering on fd, this is a joke.

this is basicly the same response I had from my OWA advisory ...

>VI. VENDOR RESPONSE
>
>Microsoft has reviewed the issue and has made the determination that
>while a bug fix may be implemented in a future service pack, a security
>advisory/patch will not be released for this issue

therefore, in the interest of everones security, iDefense released the
advisory ( as did I ) without a patch being released first.
it is quite possible they ( Microsoft ) are trying to make out like they
were'nt contacted before said advisory was released.... but that is just my
opinion on observation.

my 2 bits,

Donnie Werner