lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <52238.69.51.0.208.1146143164.squirrel@highspeedweb.net>
Date: Thu Apr 27 14:06:30 2006
From: fractalg at highspeedweb.net (Pedro Hugo)
Subject: MSIE (mshtml.dll) OBJECT tag vulnerability

>   "Just who does he think he is? [...] Zalewski may think he's some sort
of hero disclosing this information, but his is the act of a vandal.
If
>   it turns out that the bug is exploitable and abused before it's
patched,
>   then perhaps he'll be proud to be remembered for that."

He is what he wants to be... Afaik, there are no laws about disclosure.
Everyone does what he thinks it's best, even if it's best only for himself
(like Adam Smith "said", everyone acts on their own interest).
The bug requires user interaction. If most users are too stupid to click
anything, the problem will not be solved with patching.
And, even with patches, can you estimate what percentage of systems which
are patched right away ? Yeah, most aren't!

No sysadmin likes to be catched by surprise with security problems. But,
life isn't always perfect !



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ