Re: [Full-Disclosure] 3 new MS patches next week... but none fix

From: Florian Weimer (fw_at_deneb.enyo.de)
Date: 01/11/04

  • Next message: William Warren: "Re: [inbox] Re: [Full-Disclosure] 3 new MS patches next week... but none fix" 
    To: Tim <tim-security@sentinelchicken.org>
Date: Sun, 11 Jan 2004 14:32:14 +0100

    Tim wrote:

    > I realized that M$ must be giving pre-release information to major
    > vendors. Probably for a heafty price tag.

    You receive additional information if you are a Premium Support
    customer, such as a rough sketch of the upcoming security patches
    (affected products, severity of the vulnerabilities). Especially for
    those of us who live in time zones in which patches typically aren't
    released during the core working hours, this can help planning (techs
    aren't allowed to go home before 2 pm EST on the patching days,
    independent of local time, for example).

    However, I'm not sure if all Premium Support customers are treated
    equally. Before the invasion of Iraq, an IIS WebDAV exploit was
    allegedly making its rounds, and in order to protect US interests,
    there was disturbingly little information sharing, at least across the
    ocean.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: William Warren: "Re: [inbox] Re: [Full-Disclosure] 3 new MS patches next week... but none fix"