full-disclosure - Re: Two MSIE 6.0/7.0 NULL pointer crashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f26cd0911001201319g4fba5237k809391e883f03c1c@mail.gmail.com>
Date: Wed, 20 Jan 2010 22:19:40 +0100
From: Dan Kaminsky <dan@...para.com>
To: mrx <mrx@...pergander.org.uk>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Two MSIE 6.0/7.0 NULL pointer crashes

> Microsoft response: Shrug, oh wait a minute does this vulnerability effect our bottom line?
>
> OSS community response: We're on it, a fix will be available asap.

Testing takes time.  That's why both Microsoft and Mozilla test.  A
fix being *available* and a fix being *deployable* are not at all the
same things.  "Just pull the latest build from SVN" is rather
noticeably not an option.

> "Any complicated and evolving piece of software will have security
> vulnerabilities all the time." Quoted for truth.

More accurate:

"Any complicated piece of software on an active attack surface will
have software vulnerabilities found."

There's a lot of projects that stopped evolving, but still have hidden vulns.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/