full-disclosure - Re: Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45DFF59F.1080806@hardened-php.net>
Date: Sat, 24 Feb 2007 09:21:51 +0100
From: Stefan Esser <sesser@...dened-php.net>
To: Matthew Flaschen <matthew.flaschen@...ech.edu>, 
	Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Advisory 03/2007: Multiple Browsers Cross
 Domain Charset Inheritance Vulnerability

Matthew Flaschen schrieb:
> Stefan Esser wrote:
>   
>>    Microsoft just sent a nonsense mail to us, claiming that we had
>>    disclosed this already to the public and that they like getting
>>    advance notice.
>>     
>
> I mean, that's fair enough.  I mean, nobody's personality should get in
> the way of fixing security vulnerabilities.  Err, I mean...
>   

Well the point is they accused us somewhen in October 2006 to have
already disclosed this attack against Internet Explorer 7 to the public.
At that time IE7 was just released and we never said a word about IE7 at
all. Actually the only thing we did was announce that there is a trick
to do this with Firefox.In reality we waited 3.5 months before any
detail was made public with yesterdays advisory.

Stefan Esser

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/