full-disclosure - Re: ZDI-07-006: Citrix Metaframe Presentation Server Print Provider Buffer Overflow Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c3431d2e0701241535t64cd2da5y37f0661f1cd47eff@mail.gmail.com>
Date: Wed, 24 Jan 2007 17:35:54 -0600
From: "Jason Areff" <hailtheczar@...il.com>
To: "Christian Kujau" <lists@...dbynature.de>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: ZDI-07-006: Citrix Metaframe Presentation
	Server Print Provider Buffer Overflow Vulnerability

On 1/24/07, Christian Kujau <lists@...dbynature.de> wrote:
>
> On Wed, 24 Jan 2007, zdi-disclosures@...m.com wrote:
> > -- Disclosure Timeline:
> > 2005.07.07 - Pre-exiting Digital Vaccine released to TippingPoint
> > customers
> > 2006.10.02 - Vulnerability reported to vendor
> > 2007.01.24 - Coordinated public release of advisory
>
> out of curiosity: why took it 1+ year to report this vulneralbility to
> the vendor?
>
>
Where do you see 1+ year? *Pre-existing* means there already existed a
"vaccine" that blocked vulnerabilities of this type released in '05. This
does not necessarily mean that was when ZDI received the bug submission. So
it was reported to the vendor in October and released to the public in
January... 4 months is not an outstanding patch time.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/