full-disclosure - How to Report a Security Vulnerability toMicrosoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CGEFLMEEBIBHFEFOJCBDAEKKDLAA.garyo@sec-1.com>
Date: Wed Apr 27 14:18:19 2005
From: garyo at sec-1.com (Gary O'leary-Steele)
Subject: How to Report a Security Vulnerability
	toMicrosoft

Hi,

Im also trying to report a vulnerability to Microsoft but the site they
provide is broken

when i fill out and send

https://www.microsoft.com/technet/security/bulletin/alertus.aspx

I get:

We?re sorry, but we were unable to service your request. You may wish to
choose from the links below for information about Microsoft products and
services.

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk]On Behalf Of Kevin
Sent: 27 April 2005 00:11
To: Microsoft Security Response Center
Cc: full-disclosure@...ts.grok.org.uk; ntbugtraq@...tserv.ntbugtraq.com
Subject: Re: [Full-disclosure] How to Report a Security Vulnerability
toMicrosoft

On a related note, today we ran into (headfirst) a bug in Internet
Explorer with the processing of a AutoProxy scripts (Proxy Automatic
Configuration aka "PAC", a specialized subset of javascript to make
client-side web proxy routing decisions).

Eventually I isolated the problem to a broken implementation of
dnsDomainIs() in Internet Explorer, so I decided to do the right thing
and report the bug to Microsoft.  This isn't a higly critical security
flaw, so I hunted around microsoft.com and eventually found the page
on bug reporting:  http://support.microsoft.com/gp/contactbug

The page states "If you think you have found a bug in a Microsoft
product, contact our Microsoft Product Support Services department.
(800) MICROSOFT (642-7676)".  No email address, no web form, just a
phone number.

So I call this number, and after five minutes of sitting through IVR
menus, I finally reach a live human.  She asks for my name and phone
number, and as soon as I mention that I am reporting a bug in Internet
Explorer, says she will transfer my call.

At that point I get fifteen seconds of music on hold, followed by dead
air.  That was a half hour ago.

Kevin Kadow

(P.S. Yes, this is definitely a bug in MSIE -- every other browser
I've tried handles dnsDomainIs() correctly, the sole exception is
MSIE).
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

******************************************************************************************************************************************************************
NEW: Sec-1 Hacking Training - Learn to breach network security to further your knowledge and protect your network http://www.sec-1.com/applied_hacking_course.html
******************************************************************************************************************************************************************