full-disclosure - Re: About IBM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJE=EcaSnv5GjyqD63CT9h7cXE9mPC16687MJ0JuDrP4z6JVoQ@mail.gmail.com>
Date: Sun, 27 May 2012 19:41:42 -0400
From: Thomas Richards <g13net@...il.com>
To: noloader@...il.com, MustLive <mustlive@...security.com.ua>, 
	full-disclosure@...ts.grok.org.uk
Subject: Re: About IBM

Submitting to something like ZDI or Secunia may help in these cases.



On 5/27/12, Jeffrey Walton <noloader@...il.com> wrote:
> On Sun, May 27, 2012 at 4:51 PM, MustLive <mustlive@...security.com.ua>
> wrote:
>> Hello guys!
>>
>> I have a question for you about IBM. Does anybody has successfully
>> contacted
>> them, when they officially answered and fixed vulnerabilities in their
>> software, since Leandro Meiners (since 2005)?
> The question that comes to mind (for me) is what email address(es) did you
> use?
>
> Per RFC 2142, MAILBOX NAMES FOR COMMON SERVICES, ROLES AND FUNCTIONS
> (http://www.ietf.org/rfc/rfc2142.txt), security@....com should be
> monitored. I also suggest secure@....com since Microsoft made it
> somewhat popular (MS was using it around the time the RFC was
> published). There are a few others from the RFC I would use, including
> support, abuse, and noc. For web specific problems, www and hostmaster
> would be included.
>
> Additionally, the administrative and technical contacts for IBM can be
> found in any WHOIS database.
>
> I discourage folks from using a web submittal forms since using the
> website can be encumbered with legal terms. I even recall a site (the
> name escapes me) that binds you to a non-disclosure when you use their
> web portal to submit a bug.
>
> Jeff
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

-- 
Sent from my mobile device

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/