full-disclosure - Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0603241158160.31564-100000@linuxbox.org>
Date: Fri Mar 24 19:22:55 2006
From: ge at linuxbox.org (Gadi Evron)
Subject: Re: SendGate: Sendmail Multiple Vulnerabilities
 (Race Condition DoS, Memory Jumps, Integer Overflow)

On Thu, 23 Mar 2006, Eric Allman wrote:

<snip mostly relevant good replies by Mr. Allman>

> Talk to the vendors.  I've seen quite a few of their advisories come 
> by.

After or before it hit the news? You may be able to alert vendors, but
the problem with critical infrastructure is that is widely deployed around
the world. Releasing the way you did is irresponsible.

You can do non-disclosure for a while or full disclosure, you can't do
both.

> > Commentary

== personal opinion

> Yes, that's true.  If it's exploitable and people don't update, then 
> those people who choose to ignore the problem will be vulnerable. 
> You could say that about every vulnerability that has ever existed.

Indeed. And yet blaming the user is not how you solve the problem, is it?
The Internet being insecure is a give, do you blame the Internet for
telnet not being secure, or do you create SSH?

How long before enough Sendmail servers globally are patched?

> > A mounth!
> 
> Are you suggesting that it would have been better for us to have 
> released the problem without giving vendors any time at all to get it 
> integrated?  I think that would be seriously irresponsible.

I agree, my point is that if you release, do it as soon as you can as you
ARE critical infrastructure. If you want to let vendors get something
done, wait a whole lot longer than a month.

	Gadi.