full-disclosure - MSIE (mshtml.dll) OBJECT tag vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0604261738140.30005@matrix.coldrain.net>
Date: Wed Apr 26 23:01:15 2006
From: bruen at coldrain.net (bruen@...drain.net)
Subject: MSIE (mshtml.dll) OBJECT tag vulnerability

Hi Larry,

Take the Miller Analogy Test (MAT) and let me know how you make out.

The analogy was as a consumer paying for a product and having the flaws be 
public, for public safety. The products improve as the flaws are 
discovered, publicized and corrected. The government has departments, like 
the Consumer Product Safety folks, the Federal Drug Administration, the
Federal Transportation Safety Board and others to do just that. It is a 
good analogy if you understand it.

The automobile was merely one example. Other examples might be medicines, 
locks, airplanes, buildings, guns, flashlights, baby foods, chips, 
clothing, fire extinguishers, cell phones, highways, bridges, kitchen 
appliances, ski lifts, bicycles, tractors, surgical procedures, boats and 
many more in a very long list.

Actually, flaws in the locks in my car, plus kill switches, car alarms, 
etc. have been improved just so other people can not (at least not easily) 
steal my car (exploiting flaws) and then drive it where they want to go.

It's a good analogy. Software should not get a free pass.

                   cheers, bob

On Wed, 26 Apr 2006, Larry Seltzer wrote:
> There aren't people out there looking to exploit the flaws in your car in
> order to drive it where they want it to go. It's a lousy analogy.
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blog.eweek.com/blogs/larry%5Fseltzer/
> Contributing Editor, PC Magazine
> larryseltzer@...fdavis.com
>
> -----Original Message-----
> From: full-disclosure-bounces@...ts.grok.org.uk
> [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of
> bruen@...drain.net
> Sent: Wednesday, April 26, 2006 4:25 PM
> To: Tim Bilbro
> Cc: full-disclosure@...ts.grok.org.uk
> Subject: Re: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability
>
>
> Hi Tim,
>
>   Perhaps instead of viewing this as breaking into locked doors and look at
> it as consumer product information, such as problems with my automobile, it
> would not appear as such a big deal. I like product recalls and keeping
> vendors honest. Product safety has improved significantly over the past 20
> years because of the openness of the flaws. I am sure that software has and
> will continue to benefit from full disclosure of their flaws.
>
>                    cheers, bob
>
>
> On Wed, 26 Apr 2006, Tim Bilbro wrote:
>
>> You do a disservice to all IT shops by announcing these
>> vulnerabilities before contacting the vendor. I am sure it would not
>> generate as much web traffic to your site, but it is only fair and
>> right to allow at least some amount of time for the vendor to respond.
>> If you think you are helping, you are wrong. Would you go around town
>> checking which stores are unlocked at night and then publish the list
>> in the news before letting the shop owners know? That's pretty much
>> what you are doing. It's just not helping. There is no proof that it is
> either.
>>
>> Tim Bilbro
>> Information Security Specialist
>> CISSP, MCSE
>> trbilbro@...izon.net
>> web: www.bloglines.com/blog/Bilbro
>> RSS: www.bloglines.com/blog/Bilbro/rss
>>
>>
> --
> Bob Bruen
> Cold Rain Technologies
> http://coldrain.net