full-disclosure - Re: Unpatched IIS Vulnerabilities / Microsoft July Security Bulletin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 18 Jul 2012 14:00:30 +0800 (SGT)
From: sumit kumar soni <sumit_uit@...oo.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	king cope <isowarez.isowarez.isowarez@...glemail.com>
Subject: Re: Unpatched IIS Vulnerabilities / Microsoft
	July Security Bulletin

Hi Kingcop,It brings another point that did Microsoft acknowledged this vulnerability at all. did they indicate that ms will fix this issue??
--- On Mon, 16/7/12, king cope <isowarez.isowarez.isowarez@...glemail.com> wrote:

From: king cope <isowarez.isowarez.isowarez@...glemail.com>
Subject: Unpatched IIS Vulnerabilities / Microsoft July Security Bulletin
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Date: Monday, 16 July, 2012, 10:54 PM

Hi Lists,

it seems Microsoft doesn't want to patch the vulnerabilities I posted
back in June,
at least not in the July update.

The posting included some important bugs in the Internet Information
Services, one of their
flagship products:
http://seclists.org/fulldisclosure/2012/Jun/189

The July Security Bulletin doesn't mention any bug.
http://technet.microsoft.com/en-us/security/bulletin/ms12-jul

I wonder if Microsoft will silently patch the vulnerabilities or just
bluntly ignore them.
I understand that Microsoft doesn't want to make a big deal about the
impact and exposure like in the past,
yet I believe that admins should be informed about the threats by
their very side.
You have to remember that I put much effort into finding these
vulnerabilities and you get them for free.
With resolving the bugs Microsoft proves that they care about security
even if these vulnerabilties
where disclosed uncoordinated yet free to patch.

/Kingcope

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/